GHSA-7f32-hm4h-w77q github-slug-action use of `set-env` Runner commands which are processed via stdout
Attackers can execute arbitrary code by injecting commands via stdout in the github-slug-action GitHub Action.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7f32-hm4h-w77q?
GHSA-7f32-hm4h-w77q is a code injection vulnerability in rlespinasse/github-slug-action, published on 3 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
This GitHub Action use set-env runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w
Patches
The following versions use the recommended Environment File Syntax.
- 2.1.1
- 1.1.1
Workarounds
None, it is strongly suggested that you upgrade as soon as possible.
For more information
If you have any questions or comments about this advisory:
- Open an issue in rlespinasse/github-slug-action
Which versions are affected by GHSA-7f32-hm4h-w77q?
2 open source packages ship an affected version, including rlespinasse/github-slug-action.
| Package | Affected | Fixed in |
|---|---|---|
rlespinasse/github-slug-action GitHub Actions | All versions | 1.1.1 |
rlespinasse/github-slug-action GitHub Actions | From 2.0.0 | 2.1.1 |
How do I fix GHSA-7f32-hm4h-w77q?
Upgrade rlespinasse/github-slug-action to a fixed version for your release line: 1.1.1 or 2.1.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-7f32-hm4h-w77q being exploited?
There is no known exploitation of GHSA-7f32-hm4h-w77q in the wild and no public exploit code.