---
id: CVE-2026-67308
title: >-
  Wazuh workflows before 44bf114 contain a shell injection vulnerability in
  GitHub Actions that allows attackers to execute arbitrary commands by
  submitting pull requests with crafted VERSION.json files
summary: >-
  Wazuh workflows before 44bf114 contain a shell injection vulnerability in
  GitHub Actions that allows attackers to execute arbitrary commands by
  submitting pull requests with crafted VERSION.json files. Attackers can inject
  shell metachar…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-08-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:26:18.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67308'
references:
  - url: 'https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request
    label: disclosure@vulncheck.com
  - url: 'https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00729
epssPercentile: 0.54034
cvssSource: nvd
ingestedAt: '2026-08-02T07:18:01.636Z'
---

## Overview

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.