CVE-2025-47775 Bullfrog's DNS over TCP bypasses domain filtering
Attackers can bypass DNS filtering in Bullfrog GitHub Actions by using TCP, enabling data exfiltration and sandbox escape.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47775?
CVE-2025-47775 is a medium-severity vulnerability in bullfrogsec bullfrog, published on 14 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.
Weakness: CWE-201
Which versions are affected by CVE-2025-47775?
1 open source package ship an affected version, including bullfrogsec/bullfrog. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bullfrogsec/bullfrog GitHub Actions | All versions | 0.8.4 |
Products include Bullfrogsec Bullfrog.
How do I fix CVE-2025-47775?
Upgrade bullfrogsec/bullfrog to 0.8.4 or later.
Is CVE-2025-47775 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47775 exists.
Sources
Also known as GHSA-m32f-fjw2-37v3.