The vulnerability allows an attacker to inject shell metacharacters into environment variables that are directly interpolated into GitHub Actions run steps within the Wazuh CI pipeline. This flaw permits execution of arbitrary commands when a crafted pull request is merged, potentially exposing secrets such as GITHUB_TOKEN and AWS credentials. The impact is the compromise of confidentiality and integrity of the continuous integration environment, with the attacker able to execute code on self‑hosted runners.

Wazuh product. All releases before commit 44bf114 in the Wazuh repository are impacted; the vulnerability exists in the workflow configuration of those versions.

The CVSS score of 9.3 indicates critical severity. EPSS score of 0.00561 indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker who can submit a pull request with a crafted VERSION.json file that injects malicious shell commands into environment variables will trigger the vulnerable workflow and execute arbitrary commands on self‑hosted runners. The likely attack vector is via pull request submission; based on the description, it is inferred that the attacker would need write access to a repository or a fork that triggers the action.