Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34243wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`

Critical 9.8

In plain English

A critical-severity command injection in wenxian from njzjz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.2%top 17.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.

Affected products (as reported)

Vendor	Product	Versions
njzjz	wenxian	<= 0.3.1

Weakness: CWE-77, CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/njzjz/wenxian/security/advisories/GHSA-r4fj-r33x-8v88 x_refsource_CONFIRM