Skip to content
OpenAdvisories

Package · GitHub Actions

broadinstitute/cromwell

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.1
    GHSA-phf6-hm3h-x8qp

    Cromwell GitHub Actions Secrets exfiltration via `Issue_comment`

    ### Summary Using `Issue_comment` on `.github/workflows/scalafmt-fix.yml` an attacker can inject malicious code using `github.event.comment.body`. By exploiting the vulnerability, it is possible to exfiltrate high privileged `GITHUB_TOKEN` which can be used t…

    broadinstitute/cromwell GitHub Actions