GitHub Actions env var with special characters not escaped

By Kaveh Alemi·Latchkey

When an env value contains characters the shell treats specially (spaces, $, quotes, backticks), an unquoted reference in a run step can break the command or inject behavior. Quote env references and prefer the env context.

What this error means

A run step fails with a shell syntax error or behaves unexpectedly when an env var holds spaces, quotes, or shell metacharacters.

/home/runner/work/_temp/xyz.sh: line 2: unexpected EOF while looking for matching `"'

Common causes

Unquoted env reference in run

Embedding \${{ env.X }} unquoted lets the shell reinterpret special characters.

Direct expression interpolation into the script

Interpolating untrusted values directly into a run script can break or inject commands.

How to fix it

Pass via env and quote in the shell

1. Set the value as a step env var, then reference "$X" quoted in the script.
2. Avoid interpolating \${{ }} directly into run; use the env context instead.
3. Quote all shell variable expansions.

- env:
    MSG: ${{ github.event.head_commit.message }}
  run: |
    printf '%s\n' "$MSG"

How to prevent it

• Never interpolate untrusted expressions directly into a run script.
• Pass values through env and quote every shell expansion.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions