Threat reportSupply ChainTL-2026-4738
GitHub Issues/PR Comment Injection Supply-Chain Campaign Targeting 61 Public Repositories via Vulnerable Workflows
GitHub Issues/PR Comment Injection Supply-Chain Campaign (TL-2026-4738) is a high-severity supply-chain compromise, first published 2026-10-29. It has no confirmed attribution, affects GitHub GitHub Actions workflows (misconfigured, script injection via, maps to 7 MITRE ATT&CK techniques (T1027, T1059.004, T1078), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4738
- Threat ID
- TL-2026-4738
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
How GitHub Issues/PR Comment Injection Supply-Chain Campaign works
A suspected single operator using 74 GitHub accounts (many apparently compromised) published 83 issues, pull requests and comments across 61 public repositories carrying malicious shell commands hidden in HTML comments. Vulnerable GitHub Actions workflows interpolated the attacker-controlled content into shell source, executing the commands and attempting to exfiltrate environment variables to an attacker-controlled server. Reported by Radware researchers.
Radware threat hunters Gabi Nakibly and Zvika Babo identified a campaign in which an attacker publishes an issue, pull request or comment on a public GitHub repository containing malicious commands hidden inside HTML comments. The hidden text is invisible when the item is rendered on GitHub, but is present in the raw body that GitHub Actions exposes to workflows through event context.
Workflows that incorporate this attacker-controlled content directly into shell source code (script injection) run the hidden command. Per the reporting, the command collects the runner's environment variables and attempts to send them to an attacker-controlled server. Environment variables in CI frequently hold secrets such as tokens and API keys, so a successful run can yield credentials that enable further repository or downstream supply-chain compromise. Nakibly noted that the workflow is triggered automatically within a second, and if it is vulnerable the attack succeeds.
The campaign was fast and concentrated. On 2026-09-01, 77 malicious items were published within a 43-minute window; the remaining 6 were published within two minutes during the 2026-09-01 to 2026-09-03 period. A single operator is suspected. The 74 accounts used mostly had legitimate development histories, which suggests many were compromised rather than newly created. By 2026-10-13 Radware had identified 83 items with a verified payload across 61 repositories. Reported high-profile targets include agno-agi/agno, ToolJet/ToolJet, google/langextract, aquasecurity/trivy, brave/brave-browser and mlflow/mlflow, with discordjs/discord.js, cilium/cilium, dotnet/maui and Homebrew/homebrew-cask also named in the hunt context.
The public reporting does not disclose the exfiltration endpoint, exact payload commands, account names, or any CVE. The primary Radware report could not be retrieved at the time of research; this record is based on The Register's coverage of it. Radware's related GitHub-wide scan of indirect prompt injection (github.com/rdwr-gabin/github-ipi-in-the-wild) is a separate measurement study and did not describe this campaign in the retrievable content. Defender guidance from the source: apply least-privilege to CI/CD workflows, separate workflows triggered by external events from jobs with elevated permissions, treat external content as untrusted, and limit secrets and environment variables available to workflows.
MITRE ATT&CK techniques used in TL-2026-4738
Defense Evasion
T1027 Obfuscated Files or Information; T1078 Valid Accounts
Execution
Initial Access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise
Credential Access
Resource Development
Affected products and versions in GitHub Issues/PR Comment Injection Supply-Chain Campaign
- GitHub — GitHub Actions workflows (misconfigured, script injection via untrusted event content)
Vulnerable versions: Workflows that interpolate issue/PR/comment content into shell source
Remediation for GitHub Issues/PR Comment Injection Supply-Chain Campaign
Immediate actions
- Audit GitHub Actions workflows triggered by issues, issue_comment, pull_request and pull_request_target for direct interpolation of github.event.* fields (issue/PR title, body, comment body) into run: steps
- Search repository issues, PRs and comments from 2026-09-01 to 2026-09-03 for HTML comments containing shell commands
- Rotate secrets and tokens that were exposed to any workflow run triggered by a suspicious item
Workarounds
- Pass untrusted event content to scripts via intermediate environment variables rather than inline expression interpolation
- Restrict which actors can trigger workflows on first-time or external contributions
Longer-term hardening
- Apply least-privilege permissions to CI/CD workflows
- Separate workflows triggered by external events from jobs holding elevated permissions or secrets
- Treat all external content (issue, PR and comment bodies) as untrusted input
- Limit secrets and environment variables available to workflows
Weaknesses (CWE) in GitHub Issues/PR Comment Injection Supply-Chain Campaign
Timeline of GitHub Issues/PR Comment Injection Supply-Chain Campaign
- GitHub Security Lab published guidance on untrusted input in GitHub Actions workflows, documenting the script-injection class this campaign abuses
- The 43-minute burst of 77 items ended; per The Register a further 6 items were published within the following two minutes (83 items total)
- Vulnerable workflows triggered within about a second of publication, executing hidden commands and attempting to exfiltrate environment variables
- 77 malicious issues, pull requests and comments published within a 43-minute window across public GitHub repositories
- End of the 2026-09-01 to 2026-09-03 period in which the remaining 6 items were published (exact timestamp not stated in retrievable reporting)
- Radware identified 83 items with a verified payload across 61 repositories, published by 74 GitHub accounts
- The Register publishes coverage of the Radware findings naming repositories including Trivy, langextract, brave-browser and mlflow
Sources cited for GitHub Issues/PR Comment Injection Supply-Chain Campaign
- Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour (The Register)
- Who Is Prompt-Injecting Coding Agents? A Scan of 86 Million GitHub Items (Radware research coverage)
- Radware github-ipi-in-the-wild research repository
- GitHub Security Lab: Keeping your GitHub Actions and workflows secure - untrusted input
- GitHub Docs: Security hardening for GitHub Actions - script injections
Detection coverage for TL-2026-4738
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4738 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.