CVE-2026-105767: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Chainguard Chainguard Academy (edu)

This vulnerability (CVE-2026-105767) involves improper neutralization of special elements in OS commands (CWE-78) within the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu). Specifically, inputs project_id and storage_bucket are interpolated directly into Bash gcloud storage cp commands via ${{ inputs.* }} expressions without sufficient sanitization, enabling arbitrary shell command execution on the GitHub Actions runner if an attacker controls these inputs. The vulnerability existed from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff until fixed in commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3. The only in-repository caller used repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.

An attacker who can control the project_id or storage_bucket inputs in the vulnerable GitHub Action could execute arbitrary shell commands on the GitHub Actions runner. However, since the only known caller uses repository secrets and trusted triggers, the practical risk is limited. The CVSS 4.0 score is 2.1 (low severity), reflecting the limited attack vector and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3. Users should update to the fixed version of the integrate-platform-docs composite GitHub Action. Until then, restrict inputs to trusted sources and avoid exposing project_id or storage_bucket inputs to untrusted users.