Earlier quoted context omitted.
IANAL but the serious answer -- i think -- is that you always use things at your own risk, even purchased tools, and are protected via indemnity agreements. If there is no indemnity agreement (is is the case here), you assume the risk. That said, if enough people are bitten by this, i'm not sure what happens -- does anyone know of a relevant case. One somewhat relevant case that caused mass pain was the SCO Linux Dis…
If you're thinking about the liability waiver found in many licenses and contracts and EULA and other, they are often void, depends on the jurisdiction. The official answer from Github that they take all input on purpose doesn't play in their favor.
For example, if I purchase certain corporate Linux licenses, i'm protected against being sued if something in the distribution ends up having misappropriated code.
Check out the SCO Linux Dispute for how bad things can get for corporations: https://en.wikipedia.org/wiki/SCO%E2%80%93Linux_disputes