Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`
Vulnerability Description
wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Vulnerability Title
wenxian 操作系统命令注入漏洞
Vulnerability Description
wenxian是Jinzhe Zeng个人开发者的一个根据文献标识生成引用格式的工具。 wenxian 0.3.1及之前版本存在操作系统命令注入漏洞，该漏洞源于GitHub Actions工作流直接使用未经验证的用户输入执行shell命令，可能导致命令注入和任意代码执行。
CVSS Information
N/A
Vulnerability Type
N/A