Overview
This post is centered on a critical vulnerability, indexed as CVE-2025-49013, that has been discovered in several projects within the WilderForge organization. The vulnerability arises due to the unsafe use of `${{ github.event.review.body }}` and other user-controlled variables directly within shell script contexts in GitHub Actions workflows. The vulnerability concerns developers who maintain or contribute to various repositories within the WilderForge organization, and those who fork these repositories and reuse the affected GitHub Actions workflows. A successful exploit could lead to arbitrary command execution, potentially compromising CI infrastructure, secrets, and build outputs.
Vulnerability Summary
CVE ID: CVE-2025-49013
Severity: Critical (CVSS score: 9.9)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
WilderForge/WilderForge | All Versions
WilderForge/ExampleMod | All Versions
WilderForge/WilderWorkspace | All Versions
WilderForge/WildermythGameProvider | All Versions
WilderForge/AutoSplitter | All Versions
WilderForge/SpASM | All Versions
WilderForge/thrixlvault | All Versions
WilderForge/MassHash | All Versions
WilderForge/DLC_Disabler | All Versions
How the Exploit Works
The exploit works by submitting a maliciously crafted pull request review containing shell metacharacters or commands. This enables the attacker to execute arbitrary shell code on the GitHub Actions runner. The code is executed with the permissions of the workflow, potentially compromising the CI infrastructure, secrets, and build outputs.
Conceptual Example Code
Here is a
conceptual
example of how the vulnerability might be exploited. In this example, `<<< "shell command"` represents the malicious shell command or metacharacters injected into the pull request review.
POST /repos/WilderForge/WilderForge/pulls/1/reviews HTTP/1.1
Host: api.github.com
Authorization: token USER_GITHUB_TOKEN
Accept: application/vnd.github.v3+json
Content-Type: application/json
{
"body": "${{ github.event.review.body }} <<< \"shell command\"",
"event": "APPROVE"
}This request would submit an approving review for the specified pull request, and if processed by an affected GitHub Actions workflow, would execute the attacker’s arbitrary shell command.