CloudPirates-io's Helm charts contained a critical code injection vulnerability (CWE-94) in a GitHub Actions workflow named generate-schema.yaml. Before commit fcf9302, this workflow exposed sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe checkout and credential handling. This improper control of code generation could allow an attacker to execute arbitrary code with access to these credentials. The vulnerability was addressed by the patch in commit fcf9302. The CVSS 3.1 score of 10.0 reflects the critical nature of this vulnerability with high confidentiality and integrity impact and no required privileges or user interaction.

The vulnerability allows exposure of sensitive credentials (Personal Access Token and SSH signing key) to potentially malicious fork-controlled code in the GitHub Actions workflow. This can lead to unauthorized code execution and compromise of confidentiality and integrity of the affected system. The CVSS score of 10.0 indicates a critical impact with full confidentiality and integrity loss. No known exploits in the wild have been reported so far.

A patch addressing this vulnerability was introduced in commit fcf9302. Users of CloudPirates-io Helm charts should update to versions including or after this commit to remediate the issue. Since this is not a cloud service, remediation requires applying the patch to the affected workflow. Patch status is not explicitly confirmed beyond the patch commit reference; users should verify the update from the vendor repository. No additional mitigation steps are indicated by the vendor advisory.