The vulnerability exists in the MaaAssistantArknights dev‑v2 GitHub Actions workflow. An attacker can craft a pull‑request title that begins with "Release v" to inject arbitrary shell commands into the .github/workflows/release‑preparation.yml file. When the workflow runs on pull_request opened, reopened, or ready_for_review events, the unsanitized title is inserted into a run: shell command, allowing the attacker to execute arbitrary commands on the ubuntu‑latest runner during the generate‑changelog job. This results in OS command injection (CWE‑78) and dynamic expression injection (CWE‑94), giving the attacker full control over the CI environment for that run.

The flaw affects any instance of the MaaAssistantArknights project that uses the dev‑v2 workflow and includes the .github/workflows/release‑preparation.yml file before the commit that removes the injection point. Forks that allow non‑draft pull requests with titles starting with "Release v" are vulnerable until the repository is updated with the patch commit cafc3946059e6337d2089d4fec8b6885ba17c332.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. However, the attack vector requires a malicious contributor to create a specific pull request, so the exposure is relatively constrained. Once exploited, the attacker would achieve complete control over the CI runner, making the potential impact substantial despite the low exploitation likelihood.