CVE-2026-54344: ToolJet GitHub Actions Command Injection – CI Secret Exfiltration Risk

Technical summary

CVE-2026-54344 exploits improper input validation in ToolJet's render preview deployment workflow. The vulnerability exists in a GitHub Actions workflow where github.event.comment.body is directly interpolated into a bash conditional statement in a run step. This allows shell metacharacter injection. An attacker who can comment on a pull request can structure a comment payload to break out of the intended bash syntax and execute arbitrary commands with the privileges of the CI runner. The attack surface includes access to environment variables, secrets, and the build context. The issue is fixed in version 3.20.180.

Business impact

Organizations using ToolJet for internal tool development face credential compromise and potential supply-chain risk. Attackers can extract deployment secrets, API keys, and other sensitive environment variables from the CI environment, leading to unauthorized access to downstream services, data exfiltration, or lateral movement. The threat is elevated in organizations where pull request commenting permissions are broadly granted to contractors, partners, or less-trusted team members. Compromised credentials could enable unauthorized deployments or access to production systems.

Affected systems

ToolJet versions prior to 3.20.180 are affected. The vulnerability is specific to the render preview deployment workflow and impacts organizations using GitHub Actions with the vulnerable workflow configuration. Open-source deployments and self-hosted instances using the default or modified CI/CD pipeline are at risk. Organizations running ToolJet 3.20.180 or later are not vulnerable.

Exploitability

Exploitability is straightforward for any user with pull request commenting privileges on a ToolJet repository. No authentication bypass is required beyond GitHub access. The attack requires no user interaction or special configuration; a single malicious comment on an open PR triggers command execution. However, the attack is limited to the network and privilege scope of the CI runner (CVSS Attack Vector: Adjacent). The barrier to exploitation is low, making this a practical risk for organizations with permissive PR access policies.

Remediation

Upgrade ToolJet to version 3.20.180 or later. This version implements proper input sanitization for github.event.comment.body before interpolation into bash conditionals. Organizations unable to upgrade immediately should restrict pull request commenting permissions to trusted contributors only and audit GitHub Actions secrets for exposure. Review CI/CD logs for suspicious comments or command executions during the vulnerability window.

Patch guidance

Update ToolJet to version 3.20.180 or later. Verify the fix by reviewing the deployment workflow configuration to confirm that github.event.comment.body is no longer directly interpolated into bash conditionals without escaping. Organizations should test the patched version in a staging environment before deploying to production CI/CD pipelines. Check vendor advisory documentation for any breaking changes or migration steps associated with this patch.

Detection guidance

Search GitHub Actions workflow logs and audit trails for comments containing shell metacharacters (backticks, $(), ||, &&, ;, |) combined with deploy commands on pull requests. Monitor CI runner environment variable access and command execution for unusual patterns. Look for failed or successful attempts to exfiltrate secrets (grep, cat, echo of credential patterns). Organizations with SIEM integration can flag workflows triggered by comments from untrusted users. Enable GitHub's secret scanning to detect any credentials that may have been extracted.

Why prioritize this

Although CVSS score is moderate (4.7), the practical exploitability is high because any PR commenter can trigger the vulnerability without elevated privileges. The impact—credential theft and CI environment compromise—directly threatens supply chain security. Organizations with broad pull request access should prioritize patching. The vulnerability requires minimal attacker skill and effort, making it a realistic threat in most development environments.

Risk score, explained

CVSS 4.7 (MEDIUM) reflects: Adjacent network attack vector limited to CI environment; low attack complexity; no privilege requirement; but confidentiality impact (secret exfiltration) and wide scope across CI/CD systems. The score appropriately captures the localized but significant nature of CI compromise. Practical risk may be higher for organizations with permissive PR policies, justifying expedited patching beyond the base CVSS rating.

Frequently asked questions