Release: Merge back 2.57.3 into bugfix from: master-into-bugfix/2.57.3-2.58.0-dev

[github-actions]

Release triggered by rossops

[dryrunsecurity]

This pull request contains a critical finding: a GitHub Actions workflow (.github/workflows/release-3-master-into-dev.yml) uses actions/github-script and interpolates untrusted inputs (inputs.release_number_new, env.NEW_BRANCH) directly into a JavaScript string, enabling script injection that could let an attacker execute arbitrary code with the GITHUB_TOKEN's privileges. Remediation: treat these values as untrusted (escape or validate them, avoid string interpolation into code, or use the actions toolkit APIs/inputs safely) to prevent privilege-abusing injection.

🔴 GitHub Actions Script Injection in .github/workflows/release-3-master-into-dev.yml (drs_7253381e)

Vulnerability

GitHub Actions Script Injection

Description

The workflow uses actions/github-script, which executes JavaScript within a Node.js environment. Input variables like inputs.release_number_new and env.NEW_BRANCH are interpolated directly into a JavaScript string literal. An attacker could provide a crafted input containing characters like '); ... // to break out of the string literal and execute arbitrary JavaScript code. This JavaScript runs with the privileges of the GITHUB_TOKEN, which can modify PRs, add labels, and potentially interact with other GitHub API endpoints depending on the configured permissions for the workflow.

django-DefectDojo/.github/workflows/release-3-master-into-dev.yml

Lines 105 to 108 in f5eb6e0

	title: 'Release: Merge back ${{ inputs.release_number_new }} into dev from: ${{ env.NEW_BRANCH }}',
	body: `Release triggered by \`${ process.env.GITHUB_ACTOR }\``,
	head: '${{ env.NEW_BRANCH }}',
	base: 'dev'

We've notified @mtesauro.

---

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.