CVE-2026-105767

score

0.2

cvss

3.3

epss

0.2%

published

2026-10-05

kev added

—

first seen

2026-10-21

Chainguard Academy integrate-platform-docs composite GitHub Action before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 contains a command injection caused by unsanitized interpolation of project_id or storage_bucket inputs in Bash gcloud storage cp commands, letting attackers execute arbitrary shell commands on the GitHub Actions runner, exploit requires control over project_id or storage_bucket inputs.