Script injection via github.event expression in run step

What it is

A run step interpolates a github.event value — a PR title, branch name, issue body, or commit message — directly into the shell script.

Why it matters

The interpolation happens before the shell sees the line, so the value becomes part of the command. A branch named with a shell metacharacter executes as code in your runner, with the job's secrets available.

How to fix it

Pass the value through an env: variable and reference it as "$VAR" inside the script, so the shell treats it as data. Never interpolate ${{ }} directly into a run block.