What is the risk of script injection in GitHub Actions and how do you prevent it?
⚡
Quick Answer
Interpolating untrusted input (like a PR title) directly into a run: shell can execute attacker code; pass it via env instead.
Detailed Answer
${{ github.event.pull_request.title }} placed inside a run block is expanded before the shell runs, so a crafted title can inject commands. Mitigate by assigning untrusted values to an env: variable and referencing $VAR in the script, and by pinning third-party actions to a commit SHA and using least-privilege tokens.
💡
Interview Tip
This is a favorite security question — know the env: mitigation.
github-actionsinjectionsecurity