# GHSA-x6gv-2rvh-qmp6: The `steam-workshop-deploy` github action does not exclude the `.git` directory when packaging content for deployment and provide > The steam-workshop-deploy action leaks .git directories, exposing repository metadata and credentials like PATs to unauthorized users. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 13 Aug 2025 ## What is GHSA-x6gv-2rvh-qmp6? GHSA-x6gv-2rvh-qmp6 is a vulnerability in BoldestDungeon/steam-workshop-deploy, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description ## Summary The `steam-workshop-deploy` github action does not exclude the `.git` directory when packaging content for deployment and provides no built-in way to do so. If a `.git` folder exists in the target directory (e.g., due to a local Git repo, custom project structure, or via the `actions/checkout` workflow), it is silently included in the output package. This results in leakage of sensitive repository metadata and potentially credentials, including github personal access tokens (PATs) embedded in `.git/config`. Many game modding projects require packaging from the project root as the game expects certain files (assets, configuration, metadata) to be present at specific root-level paths. Consequently, the `.git` directory often exists alongside these required files and gets packaged unintentionally, especially when using `actions/checkout`. While github hosted runners automatically revoke ephemeral credentials at the end of each job, the severity of this issue increases dramatically in other CI environments: - Self-hosted runners may store long-lived tokens or secrets. - Developers may maintain their own `.git` folders with embedded PATs or remotes tied to private repositories. - The workflow may run without the `actions/checkout` action, distributing the `.git` directory present on the running machine if it exists in the directory. A real example of an affected mod can be found here: https://github.com/BoldestDungeon/wildermyth-drauven-pcs/security/advisories/GHSA-7j9v-72w9-ww6w ## Details Who is affected: - Any user of `steam-workshop-deploy` operating in an environment where `.git` exists in the packaging directory. - Any user of `steam-workshop-deploy` operating in an environment where the [actions/checkout](https://github.com/actions/checkout) workflow is used and then the `.git` directory is inadvertently generated within the packaging directory (greatly reduced severity due to the ephemeral nature of github actions). ## Impact The severity of this issue for downstream components can range from **0.0** (no credentials, sensitive metadata, or private source code were present in the packaging directory) to **10.0** (extremely sensitive, high privilige credentials or source code from private repositories were exposed). The actual severity depends primarily on the permissions, scope, and nature of the exposed data: * **Low/none (0.0-3.9)**: Only non-sensitive repository metadata was exposed, no credentials were present, or only public facing code was included. * **Medium(4.0-6.9)**: Credentials with limited repository access and/or short lifespan (e.g., ephemeral tokens) were exposed, or non-sensitive private code was disclosed. * **High/critical (7.0-10.0)**: Long-lived tokens, organization-wide credentials, or credentials with administrative privileges were exposed, potentially enabling full repository compromise, secret extraction, code tampering, or the complete leak of private repository source code. As such, each downstream consumer should independently assess their exposure by reviewing packaged artifacts for the presence of `.git` directories or other credentials, and evaluating both the sensitivity of any credentials found and the confidentiality of any included source code. Consequences may include: - Unauthorized access to git repositories via exposed PATs. - Tampering with repository code or metadata. - Malicious CI behavior (triggering workflows, reading secrets). - Disclosure of commit history, remote origins, or other sensitive internal structure. ## Recommendation This issue should be considered **severe** due to the potential exposure of sensitive tokens and repository metadata. Although most workflows that use `steam-workshop-deploy` also employ `actions/checkout`, which handles tokens and credentials more securely, there are legitimate use cases where `actions/checkout` is not used or where custom `.git` folders exist. Additionally, `actions/checkout` can accept a on-emphemeral tokens as a parameter for its workflow. In such cases, long-lived or sensitive credentials may be packaged and exposed, greatly increasing the risk of unauthorized access and repository compromise. Therefore, this issue should be considered severe regardless of common usage patterns. **Downstream:** - Downstream components should revoke any credentials or PATs associated with workflows or repositories that use this github action **This Deployment Action** - [x] The action should exclude `.git/` and other common sensitive file(s) by default from all packaging operations. - [x] A `deployignore` or similar mechanism should be introduced to give users finer control of what files or directories are included for deployed artifacts ## Which versions are affected by GHSA-x6gv-2rvh-qmp6? 2 open source packages ship an affected version, including BoldestDungeon/steam-workshop-deploy and m00nl1ght-dev/steam-workshop-deploy. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `BoldestDungeon/steam-workshop-deploy` | GitHub Actions | All versions | 2.0.0 | | `m00nl1ght-dev/steam-workshop-deploy` | GitHub Actions | All versions | 4 | ## How do I fix GHSA-x6gv-2rvh-qmp6? Upgrade BoldestDungeon/steam-workshop-deploy to 2.0.0 or later. ## Is GHSA-x6gv-2rvh-qmp6 being exploited? There is no known exploitation of GHSA-x6gv-2rvh-qmp6 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-x6gv-2rvh-qmp6 and fix it if it is affected. What it is: GHSA-x6gv-2rvh-qmp6 is a vulnerability in BoldestDungeon/steam-workshop-deploy, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-x6gv-2rvh-qmp6 in the wild and no public exploit code. Affected packages and fixed versions: - BoldestDungeon/steam-workshop-deploy (GitHub Actions): affected all versions; fixed in 2.0.0 - m00nl1ght-dev/steam-workshop-deploy (GitHub Actions): affected all versions; fixed in 4 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-x6gv-2rvh-qmp6/ (Markdown: https://insights.sbomify.com/GHSA-x6gv-2rvh-qmp6/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-x6gv-2rvh-qmp6 --- From sbomify Insights: https://insights.sbomify.com/GHSA-x6gv-2rvh-qmp6/ Summaries are generated and may contain mistakes; the official description above is the record.