Executive brief
A vulnerability in dbt-labs' GitHub Actions automation could allow an attacker to execute unauthorized commands within the software development pipeline. By posting a specially crafted comment on a public issue or pull request, an attacker can hijack the automated workflow to steal sensitive credentials or disrupt the build process. This could lead to unauthorized access to other private code repositories or the compromise of the organization's automated deployment systems.
Technical details
A command injection vulnerability exists in the reusable GitHub Actions workflow 'open-issue-in-repo.yml' within the dbt-labs/actions repository. The workflow uses the 'peter-evans/find-comment' action to retrieve comment bodies and subsequently interpolates the 'comment-body' output directly into a bash 'if' statement without escaping. An attacker can craft a malicious comment that breaks out of the shell's quoted string to execute arbitrary commands in the runner environment. This can be used to exfiltrate secrets, such as the FISHTOWN_BOT_PAT, potentially leading to broader repository access. The issue is fixed in commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9 by using environment variables for shell comparisons instead of direct interpolation.
Affected products
- dbt-labs dbt-core Versions prior to commit bbed8d28354e9c644c5a7df13946a3a0451f9ab9
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-39382 published to NVD
- 2026-04-07: patched: Fix committed to dbt-labs/actions repository