GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
21 advisories
Vault GitHub Action did not correctly mask multi-line secrets in output
High
CVE-2021-32074
was published
for
hashicorp/vault-action
(GitHub Actions)
May 24, 2022
check-spelling workflow vulnerable to token leakage via symlink attack
Critical
CVE-2021-32724
was published
for
check-spelling/check-spelling
(GitHub Actions)
Jul 29, 2022
ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File
Moderate
CVE-2022-39217
was published
for
some-natalie/ghas-to-csv
(GitHub Actions)
Sep 16, 2022
gajira-create GitHub action vulnerable to arbitrary code execution
Critical
CVE-2020-14188
was published
for
atlassian/gajira-create
(GitHub Actions)
Oct 7, 2022
run-terraform allows for RCE via terraform plan
High
CVE-2022-39326
was published
for
kartverket/github-workflows
(GitHub Actions)
Oct 19, 2022
github-slug-action vulnerable to arbitrary code execution
High
CVE-2023-27581
was published
for
rlespinasse/github-slug-action
(GitHub Actions)
Mar 13, 2023
Arbitrary command injection in embano1/wip
High
CVE-2023-30623
was published
for
embano1/wip
(GitHub Actions)
Apr 24, 2023
Data written to GitHub Actions Cache may expose secrets
High
CVE-2023-30853
was published
for
gradle/gradle-build-action
(GitHub Actions)
May 1, 2023
Actions expression injection in `filter-test-configs` (`GHSL-2023-181`)
Moderate
GHSA-hw6r-g8gj-2987
was published
for
https://github.com/pytorch/pytorch/.github/actions/filter-test-configs
(GitHub Actions)
Aug 30, 2023
tj-actions/branch-names's Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
Critical
CVE-2023-49291
was published
for
tj-actions/branch-names
(GitHub Actions)
Dec 5, 2023
memory overflow vulnerability in OpenEXR-viewer
Critical
CVE-2023-50245
was published
for
afichet/openexr-viewer
(GitHub Actions)
Dec 12, 2023
tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271)
High
CVE-2023-51664
was published
for
tj-actions/changed-files
(GitHub Actions)
Jan 2, 2024
Potential Actions command injection in output filenames (GHSL-2023-275)
High
CVE-2023-52137
was published
for
tj-actions/verify-changed-files
(GitHub Actions)
Jan 2, 2024
github-slug-action use of `set-env` Runner commands which are processed via stdout
Moderate
GHSA-7f32-hm4h-w77q
was published
for
rlespinasse/github-slug-action
(GitHub Actions)
Feb 3, 2024
fish-shop/syntax-check Improper Neutralization of Delimiters
Moderate
CVE-2024-42482
was published
for
fish-shop/syntax-check
(GitHub Actions)
Aug 12, 2024
GitHub Actions Script Injection in `ultralytics/actions`
High
GHSA-7x29-qqmq-v6qc
was published
for
ultralytics/actions
(GitHub Actions)
Aug 14, 2024
@actions/download-artifact has an Arbitrary File Write via artifact extraction
High
GHSA-cxww-7g56-2vh6
was published
for
actions/download-artifact
(GitHub Actions)
Sep 3, 2024
Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`
Low
CVE-2024-52587
was published
for
step-security/harden-runner
(GitHub Actions)
Nov 18, 2024
Artifact poisoning vulnerability in action-download-artifact v5 and earlier
High
GHSA-5xr6-xhww-33m4
was published
for
dawidd6/action-download-artifact
(GitHub Actions)
Nov 25, 2024
ProTip!
Advisories are also available from the
GraphQL API