# GitHub issue and PR payloads hit 61 repos including Trivy, Brave and MLflow in a 43-minute workflow injection campaign · pwn.watch > Radware found a coordinated campaign on Sept 1 2026: 83 issues, pull requests and comments, posted from 74 GitHub accounts (many likely compromised), aimed at 61 public repositories including Trivy, Brave, MLflow, Google LangExtract, CopilotKit, podman, cilium and Homebrew Cask. 77 of them landed within 43 minutes. Each carried a $() shell command that runs if a GitHub Actions workflow pastes the issue or PR text into a shell step, collecting the job's environment variables and sending them to an attacker server. The item doesn't need to be merged or even stay open. Run logs show the command executed in two cases; whether any tokens with write access were stolen or code changed is unknown. Maintainers were notified and most repos were fixed. Page: https://pwn.watch/i/github-issue-workflow-command-injection-campaign-61-repos · generated 2026-10-29T12:55:23.617Z ## Status - Severity: medium · status: live · patch: partial - Product: GitHub Actions workflows in public repositories - Started: 2026-09-01 - Affected: Public GitHub repositories whose Actions workflows interpolate issue, pull request or comment text (titles, bodies, comments) directly into shell run steps ## Follow this incident - RSS (one item per update): https://pwn.watch/i/github-issue-workflow-command-injection-campaign-61-repos/feed.xml - JSON Feed: https://pwn.watch/i/github-issue-workflow-command-injection-campaign-61-repos/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/github-issue-workflow-command-injection-campaign-61-repos.json - This file: https://pwn.watch/i/github-issue-workflow-command-injection-campaign-61-repos/llms.txt ## Updates (newest first) - 2026-10-29: Radware publishes the campaign. Targets include agno-agi/agno, ToolJet, google/langextract, aquasecurity/trivy, CopilotKit, podman, QwenLM/qwen-code, mlflow, discord.js, cilium, brave/brave-browser, dotnet/maui, Homebrew/homebrew-cask, github/docs, apache/doris and PX4-Autopilot. Run logs show the command executed in two cases; Radware can't say whether the attacker got write access or changed any code. Maintainers were notified and most repos were closed or fixed, but not all are confirmed. (https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153) - 2026-10-13: Radware verifies 83 malicious items (59 issues, 24 pull requests; 31 payloads in titles, 17 in bodies, 35 in comments) across 61 repositories from 74 named accounts, many with legitimate histories and likely compromised. 29 issues and 6 PRs were still open at the time. (https://www.radware.com/blog/inside-a-github-supply-chain-attack-campaign/) - 2026-09-01: Between 11:26:51 and 12:10:00 UTC, 77 issues, pull requests and comments carrying a shell command payload hit public GitHub repositories, followed by a second wave of six about two minutes long later that day. The payloads target workflows that paste issue or PR text straight into shell scripts, so the $() command runs inside GitHub Actions and tries to send the job's environment variables to an attacker-controlled server. (https://www.radware.com/blog/inside-a-github-supply-chain-attack-campaign/) ## Fix brief # Security brief: GitHub issue and PR payloads hit 61 repos including Trivy, Brave and MLflow in a 43-minute workflow injection campaign Source: https://pwn.watch/i/github-issue-workflow-command-injection-campaign-61-repos · status: live · severity: medium · updated Oct 29, 2026, 12:09 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Radware found a coordinated campaign on Sept 1 2026: 83 issues, pull requests and comments, posted from 74 GitHub accounts (many likely compromised), aimed at 61 public repositories including Trivy, Brave, MLflow, Google LangExtract, CopilotKit, podman, cilium and Homebrew Cask. 77 of them landed within 43 minutes. Each carried a $() shell command that runs if a GitHub Actions workflow pastes the issue or PR text into a shell step, collecting the job's environment variables and sending them to an attacker server. The item doesn't need to be merged or even stay open. Run logs show the command executed in two cases; whether any tokens with write access were stolen or code changed is unknown. Maintainers were notified and most repos were fixed. Severity detail: Command execution confirmed in 2 workflow runs; no confirmed repo takeover or poisoned release so far - Product: GitHub Actions workflows in public repositories ## Affected versions - Public GitHub repositories whose Actions workflows interpolate issue, pull request or comment text (titles, bodies, comments) directly into shell run steps ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Check every workflow triggered by issues, issue_comment, pull_request_target or similar events for ${{ github.event.issue.title }}, ${{ github.event.comment.body }} and similar expressions used inside run: steps. Pass them through env: variables and quote them instead. Give those workflows least-privilege permissions and no secrets, keep them apart from jobs with write tokens, and rotate any secret that a vulnerable workflow could reach since Sept 1 2026. ## Latest updates - Oct 29, 2026: Radware publishes the campaign. Targets include agno-agi/agno, ToolJet, google/langextract, aquasecurity/trivy, CopilotKit, podman, QwenLM/qwen-code, mlflow, discord.js, cilium, brave/brave-browser, dotnet/maui, Homebrew/homebrew-cask, github/docs, apache/doris and PX4-Autopilot. Run logs show the command executed in two cases; Radware can't say whether the attacker got write access or changed any code. Maintainers were notified and most repos were closed or fixed, but not all are confirmed. - Oct 13, 2026: Radware verifies 83 malicious items (59 issues, 24 pull requests; 31 payloads in titles, 17 in bodies, 35 in comments) across 61 repositories from 74 named accounts, many with legitimate histories and likely compromised. 29 issues and 6 PRs were still open at the time. - Sep 1, 2026: Between 11:26:51 and 12:10:00 UTC, 77 issues, pull requests and comments carrying a shell command payload hit public GitHub repositories, followed by a second wave of six about two minutes long later that day. The payloads target workflows that paste issue or PR text straight into shell scripts, so the $() command runs inside GitHub Actions and tries to send the job's environment variables to an attacker-controlled server. ## Write-ups & news - [Inside a GitHub Supply Chain Attack Campaign: Command Injection, Attempts to Exfiltrate CI/CD Data](https://www.radware.com/blog/inside-a-github-supply-chain-attack-campaign/) - [Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour](https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153) ## Caveats Radware's research, shared with The Register as an exclusive. Not linked to GhostAction or Gheist by any source; don't present it as the same actor. patchStatus partial: most targeted repos closed or fixed the workflows, but Radware can't confirm all of them, and 29 issues and 6 PRs were still open on Oct 13. --- Machine-readable: https://pwn.watch/i/github-issue-workflow-command-injection-campaign-61-repos.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.