Advisoriesby IbisGHSL-2026-188, GHSL-2026-189: Flag injection in MCP tool handlers via unseparated positional arguments
GitHub Security Lab (GHSL) Vulnerability Report, gh-aw: GHSL-2026-188, GHSL-2026-189
The [GitHub Security Lab](https://securitylab.github.com) team has identified potential security vulnerabilities in [gh-aw](https://github.com/github/gh-aw).
We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team.
If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at securitylab@github.com (please include GHSL-2026-188 or GHSL-2026-189 as a reference). See also [this blog post](https://github.blog/2022-04-22-removing-the-stigma-of-a-cve/) written by GitHub's Advisory Curation team which explains what CVEs and advisories are, why they are important to track vulnerabilities and keep downstream users informed, the CVE assigning process, and how they are used to keep open source software secure.
If you are _NOT_ the correct point of contact for this report, please let us know!
Summary
The gh aw mcp-server MCP tool handlers append client-supplied strings directly into the argv of spawned gh aw subprocesses without a -- separator, allowing a malicious or prompt-injected MCP client to inject hidden flags (e.g. --dir, --force, --disable-security-scanner, --approve) and escape...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| gh-aw Product | < v0.91.12 | v0.91.12 |
Details and references
# GitHub Security Lab (GHSL) Vulnerability Report, gh-aw: `GHSL-2026-188`, `GHSL-2026-189` The [GitHub Security Lab](https://securitylab.github.com) team has identified potential security vulnerabilities in [gh-aw](https://github.com/github/gh-aw). We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team. If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at `securitylab@github.com` (please include `GHSL-2026-188` or `GHSL-2026-189` as a reference). See also [this blog post](https://github.blog/2022-04-22-removing-the-stigma-of-a-cve/) written by GitHub's Advisory Curation team which explains what CVEs and advisories are, why they are important to track vulnerabilities and keep downstream users informed, the CVE assigning process, and how they are used to keep open source software secure. If you are _NOT_ the correct point of contact for this report, please let us know! ## Summary The `gh aw mcp-server` MCP tool handlers append client-supplied strings directly into the argv of spawned `gh aw` subprocesses without a `--` separator, allowing a malicious or prompt-injected MCP client to inject hidden flags (e.g. `--dir`, `--force`, `--disable-security-scanner`, `--approve`) and escape the constrained-parameter tool boundary. Additionally, the `add` tool's `name` parameter is used unsanitised in a file path, allowing path traversal outside `.github/workflows/`. ## Project gh-aw ## Tested Version 846c520 ## Details ### Issue 1: Flag injection in MCP tool handlers via unseparated positional arguments (`GHSL-2026-188`) Every MCP tool handler that spawns a `gh aw ...` subprocess appends client-supplied strings from the JSON-RPC request verbatim to argv, with no `--` end-of-options marker and no leading-`-` rejection. cobra/pflag parses interspersed flags by default, so a value beginning with `-` is consumed as a flag of the spawned subcommand instead of a positional, breaking the "only JSON-schema parameters are accessible" boundary. Sink lines (github/gh-aw HEAD `846c520`): - [`pkg/cli/mcp_tools_management.go:58`](https://github.com/github/gh-aw/blob/846c5209f8ac443380ab8f0830d858161a10737f/pkg/cli/mcp_tools_management.go#L58) (add): `cmdArgs = append(cmdArgs, args.Workflows...)` - [`pkg/cli/mcp_tools_management.go:139`](https://github.com/github/gh-aw/blob/846c5209f8ac443380ab8f0830d858161a10737f/pkg/cli/mcp_tools_management.go#L139) (update): `cmdArgs = append(cmdArgs, args.Workflows...)` - [`pkg/cli/mcp_tools_management.go:218`](https://github.com/github/gh-aw/blob/846c5209f8ac443380ab8f0830d858161a10737f/pkg/cli/mcp_tools_management.go#L218) (fix): `cmdArgs = append(cmdArgs, args.Workflows...)` - [`pkg/cli/mcp_tools_readonly.go:235`](https://github.com/github/gh-aw/blob/846c5209f8ac443380ab8f0830d858161a10737f/pkg/cli/mcp_tools_readonly.go#L235) (compile): `cmdArgs = append(cmdArgs, args.Workflows...)` - [`pkg/cli/mcp_tools_readonly.go:355`](https://github.com/github/gh-aw/blob/846c5209f8ac443380ab8f0830d858161a10737f/pkg/cli/mcp_tools_readonly.go#L355) (mcp-inspect): `cmdArgs = append(cmdArgs, args.WorkflowFile)` - [`pkg/cli/mcp_tools_privileged.go:550`](https://github.com/github/gh-aw/blob/846c5209f8ac443380ab8f0830d858161a10737f/pkg/cli/mcp_tools_privileged.go#L550) (audit): `cmdArgs = append(cmdArgs, runItems...)` - [`pkg/cli/mcp_tools_privileged.go:696`](https://github.com/github/gh-aw/blob/846c5209f8ac443380ab8f0830d858161a10737f/pkg/cli/mcp_tools_privileged.go#L696) (audit-diff): `cmdArgs = append(cmdArgs, args.CompareRunIDs...)` Hidden/undeclared flags reachable this way include (non-exhaustive): - `gh aw add`: `--dir`/`-d`, `--force`/`-f`, `--disable-security-scanner`, `--create-pull-request`/`--pr`, `--append`, `--engine` (`pkg/cli/add_command.go`). - `gh aw update`: `--dir`, `