Since execSync spawns a /bin/sh shell to execute the command, shell metacharacters provided in the CI branch name (such as $(), backticks, or ;) are interpreted and executed by the shell before the git process begins. An attacker who can influence the CI environment variables or the branch name of a triggered build - such as via a pull request - can execute arbitrary OS commands on the CI runner. This allows for the theft of repository secrets, tampering with build artifacts, or lateral movement within the CI infrastructure.

Attack Chain

1. Attacker creates a malicious pull request or branch name containing shell metacharacters, such as main$(touch /tmp/pwned).
2. The CI pipeline initiates an Argos upload process within an environment where hasRemoteContentAccess is set to false.
3. The argos CLI reads the malicious environment variable (e.g., GITHUB_HEAD_REF or ARGOS_BRANCH) and passes it into the internal config object.
4. The upload.ts module calls getMergeBaseCommitSha() using the attacker-controlled branch name as the head parameter.
5. The gitFetch() function in packages/core/src/ci-environment/git.ts receives the malicious string as the ref input.
6. The execSync() function interpolates the malicious branch string into a shell command template literal.
7. The underlying /bin/sh shell evaluates the embedded command substitution, executing the attacker's payload on the CI runner.

Impact

Successful exploitation results in full OS command execution on the build runner with the permissions of the CI agent process. This typically includes access to sensitive environment variables (API keys, cloud credentials, and repository secrets). Organizations using Argos in CI environments without external remote access verification are at risk, particularly those that process builds from untrusted contributors or forks.

Recommendation

1. Upgrade to a version of @argos-ci/core that replaces vulnerable execSync template-literal invocations with execFileSync using discrete argument arrays to prevent shell interpolation.
2. In the interim, implement strict input validation on all CI branch and reference environment variables to allow only alphanumeric characters, dashes, and underscores.
3. Review CI pipeline configurations to ensure that runners executing argos upload do not have access to sensitive secrets, or migrate to workflows that utilize hasRemoteContentAccess: true to avoid the vulnerable local Git code path.