A workflow runs on pull_request and includes run: echo "PR title is ${{ github.event.pull_request.title }}". Why is this dangerous?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Inlining ${{ }} into a shell run: script interpolates before bash runs—malicious PR titles can break out with ; ` $( ). Put untrusted data in env: and quote it instead.
Full explanation below image
Full Explanation
Expression interpolation happens while constructing the workflow job script. If untrusted content from forks or PR authors (title, body, branch name, commit message) is embedded directly into run:, attackers can inject additional shell commands. echo is allowed; titles are not always empty; the context is available to run steps—but safety matters. Recommended pattern: env: PR_TITLE: ${{ github.event.pull_request.title }} then run: echo "PR title is $PR_TITLE" with proper quoting, or use intermediate script files. Prefer pull_request over pull_request_target for untrusted code execution scenarios, keep secrets away from fork workflows, and never pass untrusted input into eval. Code scanning and security reviews should flag risky interpolations.