Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.

Affected: GitHub Actions: wktk/conflibot

### Impact

Versions of conflibot before `1.2.1` build `git` commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (`head.ref`), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as `` ` ``, `$( )`, `;`, `|`, or `&`.

The recommended workflow runs conflibot on the `pull_request_target` event, where the job has access to the base repository's secrets and a write-scoped `GITHUB_TOKEN`. As a result, a crafted branch name causes arbitrary command execution on the runner with that write token in the environment, allowing an attacker to exfiltrate secrets and the token, push to the repository, or otherwise abuse the token's permissions. No special privileges and no maintainer interaction are required — the action runs automatically when the pull request is opened.

### Affected configurations

Any workflow using `wktk/conflibot` at a version earlier than `1.2.1`. The risk is highest under `pull_request_target` (the documented configuration), because that is where the write token and secrets are exposed to attacker-influenced refs.

### Patches

Fixed in `1.2.1` and `2.0.0`. All `git` invocations now use argument arrays via `execFile`/`spawn` instead of a shell, so branch names can no longer be interpreted as shell syntax, and pull requests are referenced by number through `refs/pull/<n>/head` rather than by branch n…