---
title: "GHSA-f67f-hcr6-94mf: Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow"
url: https://erroneo.us/security/ghsa/GHSA-f67f-hcr6-94mf/
description: "GHSA-f67f-hcr6-94mf (critical, GitHub Actions): Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow.…"
type: advisory
section: "Security Digest"
date_published: 2026-03-20
date_modified: 2026-03-20
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-f67f-hcr6-94mf"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-f67f-hcr6-94mf: Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow

## Affected packages

- GitHub Actions `SHAdd0WTAka/Zen-Ai-Pentest` <= 3.0.0 → fixed: none listed

## Details

Summary The ZenClaw Discord Integration GitHub Actions workflow is vulnerable to shell command injection. The issue title field, controllable by any GitHub user, is interpolated directly into a run shell block via a GitHub Actions template expression. An attacker can craft an issue title containing a subshell expression that executes arbitrary commands on the runner during variable assignment, enabling exfiltration of the DISCORDWEBHOOKURL secret. The trigger requires no repository privileges. Affected Component File: .github/workflows/zenclaw-discord.yml Commit: 07e65c72656a8213fc9ece2b3f4fc719032cfc5d URL: https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/blob/07e65c72656a8213fc9ece2b3f4fc719032cfc5d/.github/workflows/zenclaw-discord.yml Step: Prepare Notification Trigger: issues: [opened] — no repository privileges required --- Description In the Prepare Notification step, the issue title is assigned to a shell variable using direct GitHub Actions template interpolation inside a case block: The GitHub Actions template engine resolves ${{ github.event.issue.title }} at workflow compilation time, embedding the raw issue title as literal text in the bash script before execution. The value is assigned inside a double-quoted string, which in bash evaluates subshell expressions of the form $(...) and backtick expressions ... at runtime. Although a subsequent sanitization step is applied: This sanitization runs after the assignment — the subshell in the title has already executed by the time tr and cut process the output. The sanitization is therefore ineffective as a security control against command injection. The resulting DESCRIPTION value is then written to $GITHUBOUTPUT: This additional write is performed without a multiline-safe delimiter, enabling a secondary $GITHUBOUTPUT injection if the title contains a newline, which could overwrite downstream output variables such as color or title. --- Attack Vector 1. Any GitHub user (no repository role required) opens an issue with a malicious title. 2. The issues: opened trigger fires automatically — no human interaction or approval needed. 3. The subshell expression in the title executes during variable assignment in the Prepare Notification step. 4. The injected command runs with access to…

## Sources

- [GitHub Advisory GHSA-f67f-hcr6-94mf](https://github.com/advisories/GHSA-f67f-hcr6-94mf)
- [github.com](https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/security/advisories/GHSA-f67f-hcr6-94mf)
- [github.com](https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/commit/26c4e07df780f11b7e901ad2d88b3dc5ce8a1aca)

---
Source page: https://erroneo.us/security/ghsa/GHSA-f67f-hcr6-94mf/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt