CVE-2024-8156 is a critical (CVSS 9.8) command injection in the workflow-checker.yml GitHub Actions workflow of significant-gravitas/autogpt. The branch name of a pull request was used unsafely in a shell step. The upstream commit removes the debug step that used it, and the same pattern is worth checking in your own workflows.
What's affected
This is a CI configuration problem rather than a library bug. The record names the workflow-checker.yml workflow in the AutoGPT repository, where the untrusted value github.head.ref, the name of the branch a pull request comes from, was used insecurely in a step. An attacker could craft a branch name with a command in it, open a pull request, and have the runner execute it.
The record says this could lead to reverse shell access or theft of sensitive tokens and keys. It says the issue affects versions up to the latest at the time.
The linked upstream commit is titled "Remove debug" and deletes a step called Debug Information from the workflow, which printed the head ref and other event data. That is the confirmed upstream change. The repository itself is what is affected, so this matters most to the maintainers and to anyone who copied the workflow.
How to check if you're exposed
Search your own repositories for the same pattern. In every workflow file, look for expressions that put attacker controlled values into a shell step.
grep -rn "github.head_ref" .github/workflows
grep -rn "github.event.pull_request.title" .github/workflows
grep -rn "github.event.issue.title" .github/workflows
Any match inside a run block deserves a close look. The values that are dangerous are the ones a stranger can set: branch names, pull request titles and bodies, issue titles, commit messages and author names. Then check the permissions of the token those jobs receive and which secrets they can read.
What to do now
- Search all workflow files for untrusted event values used inside run steps.
- Pass such values through an environment variable and quote them in the script instead of inlining the expression.
- Set permissions on workflows to read only by default, and grant more only where needed.
- Do not run pull request workflows from forks with access to secrets.
- Rotate any token or key that was exposed to a workflow with this pattern.
- Add a CI check that scans workflows for injection patterns.
Why it matters
GitHub Actions expands expressions into the script text before the shell runs it. If an expression contains a value controlled by a stranger, that value becomes part of the script. A branch name is a good example: it looks harmless, but git allows many odd characters in branch names.
This is command injection in CI, and CI runners are attractive targets because they hold tokens and secrets. The fix is simple in principle. Do not put untrusted values straight into scripts. Read them from environment variables, where the shell treats them as data.
The weakness class is CWE-77: Command Injection. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this a vulnerability in a package I install?
No. The record describes a workflow file in the AutoGPT repository. The lesson applies to any repository with similar workflow code.
What did upstream change?
The linked commit removes the debug step from workflow-checker.yml.
Sources
Last reviewed: 19 October 2026.
