The njzjz wenxian tool, used for generating BIBTEX files from identifiers, contains a command injection vulnerability (CWE-77) in versions 0.3.1 and prior. Specifically, a GitHub Actions workflow incorporates untrusted input from issue_comment.body directly into shell commands, enabling potential arbitrary code execution on the runner. The CVSS 3.1 base score is 9.8, reflecting the vulnerability's network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or fix is currently available.

Successful exploitation allows remote attackers to execute arbitrary commands on the GitHub Actions runner hosting the workflow, potentially leading to full compromise of the runner environment. This can result in complete loss of confidentiality, integrity, and availability of the affected system during workflow execution.

At the time of publication, no official patch or fix is available for this vulnerability. Users should avoid using affected versions (<= 0.3.1) of the wenxian tool in environments where untrusted input can reach GitHub Actions workflows. Consider disabling or restricting GitHub Actions workflows that process untrusted issue comments until a fix is released. Monitor the vendor's repository and advisories for updates and patches.