LiveCodes vulnerável a Injeção de JavaScript via título de PR não confiável no fluxo de trabalho i18n-update-pull

The vulnerability lies within LiveCode's i18n-update-pull GitHub Actions workflow. Specifically, the Pull Request title is directly interpolated into a actions/github-script JavaScript block without proper sanitization. An attacker can craft a malicious Pull Request title containing JavaScript code. When this PR is processed by the CI/CD pipeline, the injected JavaScript executes with the privileges of the CI bot token. This token has access to the LiveCode repository, allowing an attacker to potentially exfiltrate sensitive data, such as API keys, credentials, or source code. The potential impact is significant, as it could compromise the entire repository and downstream systems relying on LiveCode.

Organizations and individuals using LiveCode, particularly those with public repositories and open contribution workflows, are at risk. Teams relying on the CI/CD pipeline for automated builds and deployments are especially vulnerable, as a compromised CI bot token could lead to widespread code contamination.

• javascript: Examine GitHub Actions workflow logs for unusual JavaScript execution within the i18n-update-pull workflow. Look for unexpected network requests or file modifications. • github: Review recent Pull Requests for suspicious titles containing JavaScript-like syntax or unusual characters. • github: Monitor the CI bot token's activity for unauthorized access to repository resources. • javascript: If possible, inspect the generated actions/github-script code for injected JavaScript.

1. 2026-02-25Disclosure

   disclosure

1. Reservado2026-02-23
2. Publicada2026-02-25
3. Modificada2026-02-27
4. EPSS atualizado2026-03-23

The primary mitigation is to upgrade LiveCode to version e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 or later. This version includes a fix that properly sanitizes the Pull Request title before it is interpolated into the JavaScript block. As a temporary workaround, restrict access to the i18n-update-pull GitHub Actions workflow to trusted contributors only. Review all recent Pull Requests for suspicious titles. Consider implementing stricter code review processes to prevent the introduction of malicious code via PR titles. After upgrading, confirm the fix by attempting to create a Pull Request with a malicious title and verifying that the JavaScript is not executed.