GitHub Agentic Workflows (gh-aw)

Record description

GitHub Agentic Workflows, commonly abbreviated gh-aw, is a project for configuring and operating agentic workflows through GitHub Actions and a local MCP tool interface. October 2026 advisories identified several independent ways untrusted workflow input could cross into privileged command options, executable MCP inspection and credential-bearing helper processes. These findings concern gh-aw versions and deployment conditions, not every GitHub Actions repository or GitHub-hosted agent.

The disclosures have three separate execution boundaries. Untrusted positional strings were parsed as Cobra flags in the local MCP-to-CLI adapter; an unapproved workflow could declare an executable stdio MCP server launched by inspection; and sandbox-controlled parameters could reach a job-token-bearing sidecar through executable selection or final URL parsing. The first two pathways were reported fixed in v0.91.12. For the sidecar disclosure, structured advisory metadata names v0.91.13 while narrative text also names v0.91.12, so a deployed binary and generated workflow need version-specific verification. These were controlled research demonstrations, not a documented campaign against GitHub customers.

Explicitly related research (2)

Declared connections