CVE-2024-48908 lychee-action vulnerable to arbitrary code injection in composite action
Attackers can inject arbitrary code via the lychee-setup composite action, allowing execution within the CI/CD environment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-48908?
CVE-2024-48908 is a medium-severity code injection vulnerability in lycheeverse lychee-action, published on 28 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
Weakness: CWE-94
Which versions are affected by CVE-2024-48908?
1 open source package ship an affected version, including lycheeverse/lychee-action.
| Package | Affected | Fixed in |
|---|---|---|
lycheeverse/lychee-action GitHub Actions | All versions | 2.0.2 |
How do I fix CVE-2024-48908?
Upgrade lycheeverse/lychee-action to 2.0.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-48908 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48908 exists.
Sources
Also known as GHSA-65rg-554r-9j5x.