WIZ RED AGENT FINDS ITS WAY INTO SNOWFLAKE'S INTERNAL JIRA THROUGH A FLAW IN A GITHUB COPILOT-ASSISTED PR

Summary from the TLDR InfoSec newsletter

Wiz Research's Red Agent autonomous security research tool discovered a vulnerability in a GitHub Actions workflow in the snowflakedb/snowflake-connector-net repository that allowed attackers to gain access to Snowflake's internal Jira. The vulnerability stemmed from a regression introduced in a PR that was reviewed and approved by GitHub Copilot, enabling code execution via template injection. Users of AI-assisted code generation tools should rigorously review code for introduced vulnerabilities. In this case, Copilot introduced a vulnerability by replacing a safe env + jq parsing pattern with direct string interpolation.