Skip to content
OpenAdvisories

Package · GitHub Actions

dawidd6/action-download-artifact

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High —
    GHSA-5xr6-xhww-33m4

    Artifact poisoning vulnerability in action-download-artifact v5 and earlier

    ### Summary In versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (suc…

    dawidd6/action-download-artifact GitHub Actions