A command injection vulnerability in GitHub Super-linter versions 6.0.0 through 8.3.0 allows unauthenticated attackers to execute arbitrary code within the CI/CD pipeline.

This vulnerability is a command injection flaw occurring during file discovery processing. An unauthenticated attacker can submit a pull request containing files with shell command substitution syntax, which the Super-linter action executes, potentially leading to unauthorized access to the workflow runner environment and sensitive credentials like GITHUB_TOKEN.

The ability to execute arbitrary commands within a CI/CD workflow runner constitutes a high-severity risk to the software supply chain. Successful exploitation can lead to full compromise of the build environment, exfiltration of environment secrets, and the potential for malicious code injection into downstream software artifacts. With a CVSS score of 8.8, this flaw represents a significant threat to internal development integrity and organizational security posture.

Immediate Action: Update GitHub Super-linter to version 8.3.1 or later across all repository workflow configurations.

Proactive Monitoring: Review CI/CD workflow execution logs for unusual shell activity or unexpected command execution patterns during linting phases.

Compensating Controls: Implement strict branch protection rules and require manual code review for all pull requests to prevent the introduction of malicious filenames.

Public Exploit Available: No (exploit_available unknown).

Given the critical nature of CI/CD pipeline security, organizations must treat this vulnerability with high priority. We recommend an immediate audit of all GitHub Actions workflows using Super-linter to ensure they are updated to version 8.3.1. Failure to patch this vulnerability leaves the build environment exposed to potential supply chain attacks and unauthorized credential theft.