CVE-2026-44723 is a medium severity command injection (CVSS 5.0) in the python_checks.yml GitHub Actions workflow of Vowpal Wabbit. A pull request title is expanded straight into shell commands on the runner. Published packages are not affected, and the fix is in the project commit.
What's affected
From the project advisory:
- Affected: the workflow
.github/workflows/python_checks.ymlin the vowpal_wabbit repository. - Not affected: any published artifact, including the vowpalwabbit PyPI wheel, the NuGet packages, the WASM package, the Java JAR and the C++ library.
- Fixed: by a commit that binds the title to an environment variable. The advisory lists no released version because the issue only exists in CI configuration.
The lesson reaches beyond this project. Any repository with a workflow that puts untrusted event text into a script is open to the same pattern.
How to check if you're exposed
If you maintain a fork of the project, compare your workflow with the fixed commit. For any repository, search your workflows for expressions that insert pull request, issue or branch text into a run step:
grep -rn "github.event" .github/workflows | grep -E "title|body|head_ref|head.ref"
Anything that appears inside a run block is a candidate for the same problem.
What to do now
- If you have a fork, take the fix commit or pass the title through an environment variable and reference it as a quoted shell variable.
- Search all your workflows for event fields placed directly in run steps, and fix them the same way.
- Limit workflow permissions and keep secrets out of jobs that run on untrusted pull requests.
- Review recent workflow runs on pull requests with unusual titles.
Why it matters
The record lists CWE-78 (OS command injection) and CWE-1336 (improper neutralization in a template engine). GitHub expands the expression in a workflow before the shell runs, so the title becomes part of the script text. Quotes in the title can end the string and start a new command.
The fix works because an environment variable is read by the shell as data after the script is already parsed. This is a supply chain risk because CI runners can hold tokens and publish credentials. The record does not mark this CVE as KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to update the vowpalwabbit package?
No. The advisory says published artifacts are not affected.
Sources
Last reviewed: 19 October 2026.
