The vulnerability resides in a reusable workflow file used by dbt-labs. A bash if statement incorporates the output of peter-evans/find-comment without sanitization, allowing an attacker who can supply a comment body to break out of a quoted string and inject arbitrary shell commands. The result is that malicious commands can be executed within the workflow environment, potentially compromising the CI pipeline and any secrets it has access to.

The affected product is dbt-labs:dbt-core. No specific version information is listed, so any deployment that includes the open-issue-in-repo.yml workflow and uses the vulnerable comment handling may be impacted.

The CVSS score of 9.3 indicates a high severity, and while EPSS data is not available, the vulnerability is not currently cataloged as a known exploited vulnerability. The likely attack vector is a malicious comment posted to a repository that uses the vulnerable workflow. If an adversary can control the comment body, they can inject shell commands into the workflow’s prepare job, enabling arbitrary code execution in the CI environment.