Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

A workflow injection vulnerability was discovered in Snowflake's public GitHub repository 'snowflakedb/snowflake-connector-net' that allowed a crafted GitHub issue to trigger command injection in a CI/CD pipeline. The vulnerable workflow (.github/workflows/jira_issue.yml) directly embedded untrusted issue data into a shell run block, exposing internal Jira credentials including an API token. Researchers from Wiz exploited the flaw during authorized testing, successfully retrieving the Jira API token, which granted read access to internal engineering and security projects. The vulnerability was introduced via a commit on August 25, 2025, and was fixed on June 23, 2026, after being reported via HackerOne; no evidence of external exploitation was found.

AI-extracted · verify before operational use