published 2026-08-17
An attacker puts a command inside pull request text such as the title or branch name, and it runs inside your GitHub Actions workflow. That can expose secrets and give access to internal data; in the reported case it reached sensitive data in Snowflake's internal Jira.
Source: wiz.io
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1757 and your operating system.