CVE-2023-51664 tj-actions/changed-files command injection in output filenames
Attackers can execute arbitrary commands and leak secrets via malicious filenames in the tj-actions/changed-files GitHub Action.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-51664?
CVE-2023-51664 is a high-severity command injection vulnerability in tj-actions changed-files, published on 27 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
Which versions are affected by CVE-2023-51664?
1 open source package ship an affected version, including tj-actions/changed-files. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tj-actions/changed-files GitHub Actions | All versions | 41 |
Products include Tj-Actions Changed-Files.
How do I fix CVE-2023-51664?
Upgrade tj-actions/changed-files to 41 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-51664 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-51664 exists.
Other vulnerabilities in tj-actions changed-files
Sources
Also known as GHSA-mcph-m25j-8j63.