GitHub Actions vulnerabilities
55 vulnerabilities and 0 malicious packages in GitHub Actions. step-security/harden-runner has the most reviewed advisories.
Most exploited GitHub Actions vulnerabilities
- CVE-2026-33634 Aquasecurity Trivy Embedded Malicious Code
- CVE-2025-30154 reviewdog/action-setup GitHub Action Embedded Malicious Code
- CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code
- CVE-2026-12537 Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows
- CVE-2021-32724 check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack
- CVE-2026-34243 wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`
- CVE-2023-50245 OpenEXR-viewer memory overflow vulnerability
- CVE-2020-14188 gajira-create GitHub action vulnerable to arbitrary code execution
- CVE-2026-31976 xygeni-action v5 tag poisoned with C2 backdoor
- CVE-2023-49291 Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
- CVE-2026-55158 Conflibot: Command injection via crafted pull request branch names under pull_request_target
- CVE-2025-54416 tj-actions/branch-names Contains Command Injection Vulnerability
GitHub Actions packages with the most advisories
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.