LOTP

sergeysova/jq-action

github-actions injection eval-sh

References

• https://github.com/sergeysova/jq-action/

The input cmd is evaluated as bash. The value interpolated may contain user-input and execute commands.

steps:
- name: jq
  uses: sergeysova/jq-action@v2
  with:
    cmd: |
      jq '.[] | select(.name == "${{ github.event.inputs.name }}")' input.json