The vulnerable code uses attacker-controlled input (the list of changed files under documentation/rules in the PR), and interpolates it in a Bash script. In the context of our malicious PRs, this meant that line 18 of the code snippet evaluated to the following, which triggered code execution:
over the public internet, using a derivative of the
，更多细节参见wps
ВсеПолитикаОбществоПроисшествияКонфликтыПреступность
Долю продаваемых в России поддельных кроссовок оценили08:43