OpenChoreo Workflow Plane Templates: Authenticated OS Command Injection
- Severity
- HIGH
- Affected component
- openchoreo (github-actions)
- Patched version
- Not yet available
An authenticated OS command injection vulnerability in OpenChoreo Workflow Plane templates has been reported. This vulnerability could allow an authenticated user with permission to configure and trigger an affected workflow to execute arbitrary commands inside the corresponding workflow pod.
What happened
OpenChoreo Workflow Plane templates were reportedly vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. This vulnerability is under investigation and has not been exploited in the wild yet. The issue was first flagged on 2026-09-02T23:45:26+00:00.
An authenticated user with permission to configure and trigger an affected workflow could execute arbitrary commands inside the corresponding workflow pod. This poses a significant risk as it allows for unauthorized code execution in privileged environments.
What to do about it
- Upgrade to the latest version of OpenChoreo to mitigate the risk of this vulnerability.
- Review and update any affected workflows to ensure they are not vulnerable to command injection.
- No official fix has been published yet for the affected components. Monitor the primary sources below for updates.
- Consult the primary sources for the most current information on this vulnerability.
How 0Day would have caught this
openchoreo is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using OpenChoreo Workflow Plane templates. Consult the primary sources for more detailed information on affected components and version ranges.
What should I do right now?
Upgrade to the latest version of OpenChoreo and review and update any affected workflows to ensure they are not vulnerable to command injection. Monitor the primary sources for updates on this vulnerability.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for updates.
Where can I find more information?
Consult the primary source at https://github.com/openchoreo/openchoreo/security/advisories/GHSA-2mw5-23gm-pccq for the latest information.