[sighthound] Security findings in github/gh-aw

[github-actions]

Security Findings (Sighthound Scan)

The following Critical severity findings were identified outside test paths. All are CWE-78 (Command Injection) flagged by Sighthound with High confidence.

#	File	Line	Function	Snippet
1	pkg/gitutil/gitutil.go	179	ReadFileFromHEAD	exec.Command("git", "-C", gitRoot, "show", "HEAD:"+relPath)
2	pkg/workflow/dependabot.go	346	global	exec.Command(npmPath, "install", "--package-lock-only")
3	pkg/workflow/pip_validation.go	82	global	exec.Command(pipCmd, "index", "versions", pkgName, "--pre")
4	pkg/cli/upgrade_command.go	493	relaunchWithSameArgs	exec.Command(exe, newArgs...)
5	pkg/cli/runner_guard.go	75	runRunnerGuardOnDirectory	exec.Command("docker", "run", ..., gitRoot+":/workdir", ...)

Remediation Guidance

• CWE-78 (Command Injection): Validate and sanitize all dynamic values used as command arguments. Never concatenate untrusted input directly into command strings (e.g., "HEAD:"+relPath). Prefer allow-lists for executable paths (npmPath, pipCmd, exe), and verify that runtime-derived paths (gitRoot, containerScanPath, newArgs) cannot be influenced by untrusted external input.
• For path arguments (e.g., gitRoot), validate they resolve within expected boundaries using filepath.Clean and check against a known base path before use.
• For executable paths (npmPath, pipCmd, exe), resolve them with exec.LookPath from a controlled environment or hard-coded allow-list.

Total actionable findings in scan: 137. Showing top 5 by severity.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🛡️ Sighthound Security Scan · sonnet46 11.7 AIC · ⌖ 5.6 AIC · ⊞ 4.4K · ◷