The integrate‑platform‑docs composite action in Chainguard Academy (edu) contains a command‑injection flaw: user‑supplied inputs that supply the project identifier or storage bucket are inserted directly into Bash gcloud commands via Hi‑level expression interpolation. Those inputs become part of the shell command, allowing an attacker with control over any of those parameters to execute arbitrary shell commands on the GitHub Actions runner without authentication. The weakness is an instance of Command Interpolation, modelled by CWE‑78. In practice, the repository only ingests secrets from this action and runs on trusted triggers, so an uncontrolled attacker would need to compromise the workflow or contribute a malicious workflow file to gain the required inputs.

The issue affects the Chainguard Academy (edu) GitHub repository and its integrate‑platform‑docs composite action. The CVE applies to any workflow that references the action at a commit prior to fb0efb2537d326ab18c07d620875b8ed2a4b39f3. No specific external vendors or products beyond the action itself are impacted.

With a CVSS score of 2.1, the vulnerability is considered low severity. The exploit requires an attacker to supply malicious input to the action’s project_id or storage_bucket fields, which in a typical secure workflow is constrained to secrets defined inside the repository. No public exploit has been reported, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation in current deployments is low, but the impact of a successful exploit would be remote code execution on the runner. Organizations should treat the issue as a low‑risk potential vector and apply the provided patch promptly to eliminate the interpolation path.