Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Researchers at Wiz discovered a vulnerability in Snowflake's public repository on GitHub, specifically in a workflow file that could be exploited to execute commands. This could be done by creating a crafted GitHub issue that triggers command injection in the workflow. The vulnerable workflow file contained internal Jira credentials, making it a potential target for exploitation. The issue was found in a specific YAML file related to Jira issues. The vulnerability allows for the execution of commands within the workflow when a crafted issue is created.