GHSL-2026-180: Argv flag injection from MCP client into spawned `gh aw` subcommands

# GitHub Security Lab (GHSL) Vulnerability Report, gh-aw: `GHSL-2026-180` The [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [gh-aw](https://github.com/github/gh-aw). We are committed to working with you to help resolve this issue. In this report you will find everything you need to effectively coordinate a resolution of this issue with the GHSL team. If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at `securitylab@github.com` (please include `GHSL-2026-180` as a reference). See also [this blog post](https://github.blog/2022-04-22-removing-the-stigma-of-a-cve/) written by GitHub's Advisory Curation team which explains what CVEs and advisories are, why they are important to track vulnerabilities and keep downstream users informed, the CVE assigning process, and how they are used to keep open source software secure. If you are _NOT_ the correct point of contact for this report, please let us know! ## Summary The `gh aw mcp-server` MCP tool handlers append client-supplied strings verbatim into the argv of spawned `gh aw <subcmd>` child processes without a `--` separator or leading-`-` rejection. A less-trusted MCP client can smuggle forbidden flags (e.g. `--force`, `--disable-security-scanner`, `--create-pull-request`, `--repo`, `--approve`) into the child cobra process, escaping the MCP sandbox and abusing the operator's `gh` credentials. ## Project gh-aw ## Tested Version 846c520 ## Details ### Argv flag injection from MCP client into spawned `gh aw` subcommands (`GHSL-2026-180`) Each MCP tool handler builds a `[]string` argv, appends MCP-client-supplied string values directly as positional args, and invokes `execCmd()` (`pkg/cli/mcp_server.go:21-28`) → `exec.CommandContext(<gh-aw>, args...)`. No handler rejects values starting with `-`, none inserts a `--` separator, and `SetInterspersed(false)` is never called on any child command, so cobra/pflag parses any `-`-prefixed positional as a flag. Vulnerable sinks: - `add` tool — https://github.com/github/gh-aw/blob/846c520/pkg/cli/mcp_tools_management.go#L57-L71 ```go cmdArgs := []string{"add"} // ... cmdArgs = append(cmdArgs, args.Workflows...) // untrusted []string forwarded verbatim // ... cmd := execCmd(ctx, cmdArgs...) ``` Child flags include `--create-pull-request`, `--force`, `--disable-security-scanner`, `--dir` (see `pkg/cli/add_command.go`). - `update` tool — https://github.com/github/gh-aw/blob/846c520/pkg/cli/mcp_tools_management.go#L141-L155 ```go cmdArgs := []string{"update"} cmdArgs = append(cmdArgs, args.Workflows...) execCmd(ctx, cmdArgs...) ``` Child flags include `--repo`, `--create-pull-request`, `--disable-security-scanner`, `--dir`. - `fix` tool — https://github.com/github/gh-aw/blob/846c520/pkg/cli/mcp_tools_management.go#L223-L237 ```go cmdArgs := []string{"fix"} cmdArgs = append(cmdArgs, args.Workflows...) execCmd(ctx, cmdArgs...) ``` Child flags include `--dir`, `--write`. - `compile` tool — https://github.com/github/gh-aw/blob/846c520/pkg/cli/mcp_tools_readonly.go#L183-L224 ```go cmdArgs := []string{"compile", "--validate", "--json"} // ... cmdArgs = append(cmdArgs, args.Workflows...) // ... cmdArgs = append(cmdArgs, "--prior-manifest-file", cached) execCmd(ctx, cmdArgs...) ``` Child flags include `--approve`, `--purge`, `--dir`, `--trial`, `--staged`. - `mcp-inspect` tool — https://github.com/github/gh-aw/blob/846c520/pkg/cli/mcp_tools_readonly.go#L314-L332 ```go cmdArgs := []string{"mcp", "inspect"} cmdArgs = append(cmdArgs, args.WorkflowFile) execCmd(ctx, cmdArgs...) ``` Child flags include `--inspector`, `--server`, `--tool`. - `audit` tool — https://github.com/github/gh-aw/blob/846c520/pkg/cli/mcp_tools_privileged.go#L386-L407 ```go cmdArgs := []string{"audit"} cmdArgs = append(cmdArgs, runItems...) // hard-coded -o and --json appe

CVSS 4.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-88

• github.com/github/gh-aw/security/advisories/GHSA-f7r8-5pqp-q5p4
• github.com/github/gh-aw