Executive brief
Vowpal Wabbit is an open-source machine learning system. A security flaw in its automated testing process allowed an attacker to execute unauthorized commands on the project's build servers by submitting a pull request with a specially crafted title. While this does not affect the security of the machine learning software itself when used by customers, it could have allowed an attacker to disrupt the development process or gain access to the project's build environment.
Technical details
A command injection vulnerability exists in the Vowpal Wabbit GitHub Actions workflow `.github/workflows/python_checks.yml`. The workflow used expression interpolation `${{ github.event.pull_request.title }}` directly within double-quoted bash strings across four different jobs. Because the `pull_request` trigger runs on all branches without an access gate, an attacker can craft a pull request title (e.g., using backticks or shell operators like `&&`) to break out of the bash string and execute arbitrary commands on the GitHub Actions runner. This is a classic GitHub Actions injection pattern where untrusted user input is treated as code by the shell. The issue was resolved by mapping the pull request title to an environment variable and referencing that variable in the script, ensuring the shell treats the input as data rather than executable code.
Affected products
- VowpalWabbit vowpal_wabbit All versions prior to commit 998e390e80a7e8192d7849b7784bc113dbd190ad
Timeline
- 2026-05-05: advisory: GitHub Security Advisory GHSA-cg2g-xgg7-3xxq published
- 2026-05-26: disclosed: CVE-2026-44723 published to NVD
- 2026-05-26: patched: Fix committed in 998e390e80a7e8192d7849b7784bc113dbd190ad