Command injection vulnerability in changelog.yml CI workflow

The changelog.yml workflow is vulnerable to command injection attacks because of using an untrusted github.head_ref field.

Line 18 in 37bfb87

echo "INFO: source branch is: ${{ github.head_ref }}"

The github.head_ref value is an attacker-controlled value. Assigning the value to zzz";echo${IFS}"hello";# can lead to command injection.

Since the permission is not restricted, the attacker has a write-access to the repository.

Provide feedback