Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-58502— githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

Quick assessment

Affected
gouef githubtoplanguages
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

githubtoplanguages 项目用于生成用户 GitHub 上使用最多的编程语言列表，并以 SVG 格式输出。在 工作流中，当 GitHub 上的 issue 被创建或关闭时，该工作流会直接将会话标题 插入到 Bash 变量 的赋值语句中，且在 shell 解析之前未做任何转义或过滤。因此，如果 issue 标题中包含 shell 命令替换（command-substitution）语法（如 或反引号），攻击者即可在 GitHub Actions runner 上执行任意命令，随后该标题才会被包含在通过

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
gouef githubtoplanguages < 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-58502

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow
Source: CVE Program / CVE List V5
Vulnerability Description
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
gouef githubtoplanguages < 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027 -

II. Public POCs for CVE-2026-58502

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-58502

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-58502 (1)

Vendor Advisories for CVE-2026-58502 (1)

IV. Related Vulnerabilities

Same weakness: CWE-78

V. Comments for CVE-2026-58502

No comments yet

Leave a comment