tsParticles: Generated release notes can execute shell commands in the stable publish workflow

Summary

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.

Remediation

1. Inventory every tsparticles tsparticles deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896
• Referencehttps://github.com/tsparticles/tsparticles/pull/5888
• Referencehttps://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx