Actions: Add experimental prompt injection queries for CWE 1427#21675
Draft
data-douser wants to merge 2 commits intogithub:mainfrom
Draft
Actions: Add experimental prompt injection queries for CWE 1427#21675data-douser wants to merge 2 commits intogithub:mainfrom
data-douser wants to merge 2 commits intogithub:mainfrom
Conversation
Add detection for prompt injection vulnerabilities (CWE-1427) in GitHub Actions workflows that use AI inference actions. New queries: - PromptInjectionCritical.ql: Detects user-controlled data flowing into AI prompts in privileged contexts (severity 9.0) - PromptInjectionMedium.ql: Detects prompt injection on non-privileged but externally triggerable events like pull_request (severity 5.0) New library: - PromptInjectionQuery.qll: Taint tracking from remote flow sources to MaD-defined prompt-injection sinks MaD model (prompt_injection_sinks.model.yml): - 30+ AI actions including actions/ai-inference, anthropics/claude-code-action, google-github-actions/run-gemini-cli, warpdotdev/oz-agent-action, and others ControlChecks.qll: Add 'prompt-injection' to control check categories
| @@ -0,0 +1 @@ | |||
| experimental/Security/CWE-1427/PromptInjectionCritical.ql | |||
| @@ -0,0 +1 @@ | |||
| experimental/Security/CWE-1427/PromptInjectionMedium.ql | |||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Actions: Add experimental CWE-1427 prompt injection queries
Description
Adds detection for prompt injection vulnerabilities (CWE-1427) in GitHub Actions workflows that pass user-controlled data into AI inference action prompts.
As AI-powered GitHub Actions (e.g.
actions/ai-inference,anthropics/claude-code-action,google-github-actions/run-gemini-cli,warpdotdev/oz-agent-action) become more widely adopted in CI/CD workflows, attackers can craft malicious issue titles, PR bodies, comments, or branch names that get interpolated directly into AI prompts — potentially hijacking AI behavior to exfiltrate secrets, produce misleading output, or influence downstream automation.New queries
actions/prompt-injection/criticalissues,issue_comment,pull_request_review,repository_dispatch,workflow_run, etc.)actions/prompt-injection/mediumpull_request,pull_request_targetwith read permissions) not already caught by CriticalNew library and MaD models
PromptInjectionQuery.qll: Taint-tracking configuration fromRemoteFlowSourceto MaD-definedprompt-injectionsinks, with severity-tiered predicates for Critical vs Medium.prompt_injection_sinks.model.yml: 30+actionsSinkModelentries covering GitHub official AI actions, Anthropic, Google, OpenAI, Warp, and community AI actions from the GitHub Marketplace.ControlChecks.qll: Added"prompt-injection"to control check categories so existingActorCheck,AssociationCheck, etc. can suppress findings where appropriate.Variant analysis results
The queries were validated through MRVA across 479 CodeQL
actionsdatabases:pull_request_targetevents with read-only permissions (previously missed)AssociationCheck(author_association) andActorCheck(github.actor) control checksTest coverage
issues,issue_comment,repository_dispatch,pull_request,pull_request_review,pull_request_target,workflow_runevents across 4 different AI actions) and 4 safe (hardcoded prompts,pushevents, author_association checks, actor checks)References