Interpolating an attacker-controlled event field (issue/PR title or body, comment/review body, commit message) directly into a workflow expression lets an attacker inject shell/script when it reaches a run: step — the classic pwn-request script-injection. Use an intermediate env: var and reference it as "$VAR", or an actions/github-script args object.
Never inline untrusted event fields into an expression. Assign to an env var (env: TITLE: ${{ github.event.issue.title }}) and use "$TITLE" in run:, quoted.