CLAIM-2026-08-21-02

The vulnerability was in .github/workflows/jira_issue.yml, where the GitHub issue title expression was interpolated directly into a shell run: step, allowing command injection via a crafted issue title.

Sources

• wizresearch2026red
• githubsnowf2026snow