CVE-2026-34243 wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`
Attackers can execute arbitrary code on CI runners by injecting commands into issue comments processed by the wenxian tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34243?
CVE-2026-34243 is a critical command injection vulnerability in njzjz wenxian, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.
Which versions are affected by CVE-2026-34243?
1 open source package ship an affected version, including njzjz/wenxian. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
njzjz/wenxian GitHub Actions | All versions to 0.3.1 | None |
Products include Njzjz Wenxian.
How do I fix CVE-2026-34243?
No fix has been published for CVE-2026-34243 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-34243 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34243 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-r4fj-r33x-8v88.