CVE-2023-28430 OneSignal repository github action command injection

OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues types: closed i.e., when an Issue is closed. The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on...

CVE-2023-28430

OneSignal GitHub Actions vulnerability CVE-2023-28430 enables an issue-closure workflow step to receive data from the issue title, using a repository token with full write permissions. This CodeQL-detected expression injection could let an attacker take over the GitHub Runner and execute commands...