Repository navigation
[sighthound] Security findings in github/gh-aw #70796
Description
Sighthound findings
The scan reported these five Critical findings with High confidence. Review whether untrusted values can reach each command invocation; the scan does not establish exploitability.
pkg/cli/runner_guard.go:122— Critical, command injection (exec.Command(dockerPath, dockerArgs...)). ConstraindockerPathto a trusted executable and validate each generated Docker argument.pkg/cli/zizmor.go:206— Critical, command injection (exec.Command(dockerPath, dockerArgs...)). Validate the Docker argument list and reject untrusted command options or paths.pkg/cli/zizmor.go:174— Critical, command injection (exec.Command(localPath, args...)). ResolvelocalPathto a trusted executable and validate arguments before execution.pkg/cli/grype.go:366— Critical, command injection (exec.Command(dockerPath, dockerArgs...)). Constrain the executable path and validate dynamic Docker arguments, especially image and mount inputs.pkg/cli/upgrade_command.go:599— Critical, command injection (exec.Command(exe, newArgs...)). Ensure the relaunched executable path is trusted and validate forwarded arguments.
Source: Sighthound actionable findings, workflow run 39549053316.
Generated by 🛡️ Sighthound Security Scan · codex · gpt60 · 11.9 AIC · ⌖ 5.34 AIC · ⊞ 12.4K · ◷
Activity
github-actions commentedon Oct 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Oct 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Oct 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Oct 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Oct 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Oct 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Oct 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
github-actions commentedon Oct 22, 2026
This issue is being closed as outdated. A newer issue has been created: #71048
View newer issue
This action was performed automatically by the
Sighthound Security Scanworkflow.