CVE-2026-39866

This repository is a small Node.js-based educational lab and proof-of-concept for CVE-2026-39866, a command injection issue caused by unquoted workflow-dispatch input in a GitHub Actions release workflow associated with Lawnchair. The repo contains six files: a README with vulnerability explanation and usage instructions, a Dockerized Express application under app/, a docker-compose file that runs vulnerable and patched variants side-by-side, and a minimal standalone PoC under poc/. The main exploit capability is arbitrary command execution via attacker-controlled input placed into a shell command without quoting. In app/server.js, the vulnerable POST handler at /workflow/vulnerable reads artifactName from a submitted form and builds the command `mv ${artifactName}.zip lawnchair.zip`, then executes it with child_process.execSync. Because artifactName is inserted directly into the shell command, shell metacharacters such as `;` and `#` allow command injection. The patched route /workflow/patched demonstrates the fix by quoting the interpolated value: `mv "${artifactName}.zip" lawnchair.zip`. The standalone poc/exploit.js is not a remote exploit against GitHub itself; it is a local demonstration server that listens on port 3000 and, on startup, executes a simulated vulnerable shell command (`echo file.zip; id #`) to show how injected commands run. This makes the repository an operational PoC/lab rather than a weaponized exploit framework. Network-exposed functionality is limited to local HTTP services: the Express lab serves a form at / and accepts POST requests at /workflow/vulnerable and /workflow/patched; docker-compose maps these to localhost:3000 and localhost:3001 respectively. The exploit does not beacon to external infrastructure or contain C2 logic. Its purpose is to reproduce and explain the injection primitive, compare vulnerable versus patched behavior, and help users understand how unquoted workflow inputs in GitHub Actions can lead to command execution on runners.