pvharmo2/gha-lab-25b7988758Authorized security-research reproduction of CVE-2026-27701 / GHSA-xh9w-5859-x97j (live-codes/livecodes @ 8017e01): untrusted PR title interpolated into i18n-update-pull github-script block.
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
live-codes/livecodesat commit8017e0146fc020b8e9ec4115afc6f7b228354e46(2026-02-21), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2026-02-21; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
A Code Playground That Just Works!
A feature-rich, open-source, client-side code playground for React, Vue, Svelte, Solid, Typescript, Python, Go, Ruby, PHP and 90+ languages/frameworks.
* GitHub account is required only for features that use GitHub Integration.
... and enjoy all the features!
Add this code to your page:
<div id="container"></div>
<script type="module">
import { createPlayground } from 'https://cdn.jsdelivr.net/npm/livecodes';
createPlayground('#container', {
params: {
markdown: '# Hello LiveCodes!',
css: 'h1 {color: dodgerblue;}',
js: 'console.log("Hello, from JS!");',
console: 'open',
},
});
</script>
Check documentations for Embedded Playgrounds.
... and it just works!
For details check the full list of features.
The Software Development Kit (SDK) provides an easy, yet powerful, interface to embed and communicate with LiveCodes playgrounds.
The SDK is provided as a light-weight (less than 5kb gzipped), zero-dependencies npm package, that is also available from CDNs. It can be used to create playgrounds with a wide variety of configurations and embed options. In addition, SDK methods allow programmatic communication and control of the playgrounds during runtime.
npm i livecodes
Example: (open in LiveCodes)
import { createPlayground } from 'livecodes';
createPlayground('#container', {
config: {
markup: {
language: 'markdown',
content: '# Hello World!',
},
},
view: 'result',
});
The JavaScript SDK is framework/library agnostic. However, wrapper components are also provided for popular libraries (currently React and Vue). The SDK can be used in Svelte and Solid directly without wrappers. TypeScript support provides type-safety and a great developer experience.
React SDK example: (open in LiveCodes)
import LiveCodes from 'livecodes/react';
const config = {
markup: {
language: 'markdown',
content: '# Hello World!',
},
};
const Playground = () => <LiveCodes config={config} view="result" />;
export default Playground;
Vue SDK example: (open in LiveCodes)
<script setup>
import LiveCodes from 'livecodes/vue';
const config = {
markup: {
language: 'markdown',
content: '# Hello World!',
},
};
</script>
<template>
<LiveCodes :config="config" view="result" />
</template>
In addition, the SDK allows creating links to playgrounds:
import { getPlaygroundUrl } from 'livecodes';
const url = getPlaygroundUrl({
config: {
markup: {
language: 'markdown',
content: '# Hello World!',
},
},
});
console.log(url);
See SDK docs for more details.
Comprehensive documentations for features, getting started, configuration and SDK are available on:
The documentations include demos, code samples, screenshots, Storybook and TypeScript types.
Keep up with the latest changes:
We welcome feedback!
Please start a new issue or discussion.
For security reports please refer to SECURITY.md.
You may also reach out to us using the contact form.
Contributions are welcome and highly appreciated.
A huge shout-out to our wonderful contributors! Your hard work makes all the difference!
Please refer to the contribution guide.
LiveCodes uses services that are generously provided by:
Packages used by LiveCodes and their licenses are listed here.
MIT License © Hatem Hosny
LiveCodes is free and open-source. The app does not contain ads or require subscription. It allows unlimited usage without any restrictions.
By sponsoring LiveCodes, you will be supporting the ongoing development and maintenance of the project, as well as helping to ensure that it remains a valuable resource for the developer community.
Please consider becoming a sponsor. i18n ci exercise