A Refactor Traded a Safe Pattern for String Interpolation
The file at fault is .github/workflows/jira_issue.yml. The original code stored the issue title in an environment variable and assembled JSON with jq — the safe pattern GitHub itself recommends. The refactor interpolated the title straight into a shell echo and relied on sed for escaping. The ordering is what breaks it: GitHub's template expansion happens first and the sed escaping second, so a single quote in the title escapes the quoted string before sanitization ever applies. A separate conditional read pull_request.user.login, and because pull_request is null on issue events, the gate that should have stopped outsiders evaluated true — leaving the path open to unauthenticated users. What the agent obtained: an out-of-band callback from the runner, the Jira base URL, and a Jira API token belonging to qa@snowflake.net with read access to engineering, security compliance and bug bounty projects. The timeline is tight: PR #1218 introduced the flaw on June 18, Red Agent reported it through HackerOne on June 23 (report #3819931), and Snowflake fixed it the same day via PR #1402. Snowflake says it found no evidence of unauthorized access. No CVE was assigned, and because the weakness lived in repository automation, it never shipped in a connector release.
Two Accounts That Do Not Match
This part needs to be stated carefully. Wiz initially said a GitHub Advanced Security scan with Copilot Autofix analyzed the final PR revision without flagging the injection. On August 17 it updated that to: Copilot was a co-author that checked the merged PR and the code change and identified it as all-clear — while acknowledging it cannot tell whether the change itself was AI-assisted. GitHub's response is a flat denial: a human wrote the contributions that led to the vulnerability, and Copilot Autofix neither reviewed nor contributed to them. The visible evidence favors GitHub's timeline. The unsafe refactor appears in an August 25, 2025 commit attributed to a named Snowflake engineer, and Copilot's co-author line comes from the trailer on the June 18 squash merge — a co-author credit shows it was present in PR #1218, not that it wrote those lines. The scan logs that would settle it sit with GitHub alone and have not been published. Until then, the claim that Copilot Autofix cleared a vulnerability should be treated as unconfirmed.
For People Who Write CI
The transferable lesson: GitHub published guidance on exactly this class of workflow injection in July 2025, warning against expanding untrusted issue data directly inside run blocks and recommending an intermediate environment variable — and the commit that introduced the flaw came a month after that guidance. Auditing issue titles, PR titles and branch names as attacker-controlled input is more useful than arguing over which lines an AI wrote.
via: Wiz Red Agent technical blog, The Hacker News, The Next Web (GitHub's response), Infosecurity Magazine