I Read 25 Release Pipelines Looking for One Bug. Four Had It.
There is one line of YAML I have been chasing across open source for months: run : | TAG="${{ github.event.release.tag_name }}" It looks like reading a variable. It is not. ${{ ... }} is a template expression . GitHub substitutes it as raw text into the script before bash ever parses the line. By the time the shell runs, there is no variable — there is whatever the tag name happened to be, pasted…
In a recent investigation into 25 open source projects, 4 were found to contain a security vulnerability in their release pipelines. This bug arises from the use of template expressions in YAML workflows, which substitute raw text into the script before any parsing occurs. As a result, a tag name directly pasted into the program is executed without any comparison.
The primary location for this bug is in release workflows, specifically where version strings, tag names, and workflow_dispatch inputs are handled. These workflows also tend to have access to sensitive credentials, such as permissions allowing write access to distribute packages to users. The JavaScript variant of this issue is more difficult to detect due to its script-like appearance, but the underlying flaw remains the same.
To address this vulnerability, a simple fix involves passing the value through an environment variable, which is never re-parsed as source text. The recommended changes include using environment variables instead of interpolation in both YAML and JavaScript files, and adding additional permissions blocks to ensure the least privilege principle is followed.
During the audit, four projects were found to have this vulnerability: crewAI, polybar, in-toto, and TEN Framework. All of these required push access to trigger, meaning the release or dispatch of a workflow was necessary. However, none of these vulnerabilities could be exploited by an anonymous user, as they required existing permissions to manipulate the release process.
The author emphasizes the importance of accurately describing the severity of these findings, as labeling everything as "critical" can lead to a lack of interest in future reports. Instead, maintainers should focus on the actual impact of the vulnerability, which is the removal of a step between the ability to create a release and controlling the publishing identity. This escalation, while significant, should not be considered the end of the world.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
