A critical OS command injection vulnerability in the WPGraphQL repository's CI pipeline allows attackers to execute arbitrary commands on GitHub Actions runners.

The vulnerability resides in the release.yml GitHub Actions workflow, which improperly handles input from pull request bodies. By injecting malicious payloads into a pull request body, an authenticated user with permission to trigger the workflow can achieve remote code execution on the build environment.

The vulnerability allows for unauthorized code execution within the development pipeline, potentially leading to the compromise of build artifacts, the leakage of stored secrets (such as API keys or deployment credentials), and the integrity loss of the software supply chain. Given the CVSS score of 7.7, this represents a high-severity risk to development infrastructure and downstream users who rely on the integrity of the plugin updates.

Immediate Action: Update the WPGraphQL plugin to version 2.9.1 or later to implement the corrected workflow logic.

Proactive Monitoring: Review GitHub Actions execution logs for any suspicious shell command activity or unexpected workflow triggers originating from pull request events.

Compensating Controls: Restrict permissions for creating or merging pull requests within the repository to trusted contributors, and audit any stored GitHub repository secrets for potential unauthorized access.

Public Exploit Available: Unknown (No confirmed public exploit in available data)

This vulnerability poses a significant risk to the security of the development lifecycle and the integrity of the WPGraphQL project. Organizations using this plugin should prioritize upgrading to version 2.9.1 immediately to eliminate the command injection vector. Failure to patch may expose build environments to unauthorized access and potential downstream supply chain compromise.