Skip to content
OpenAdvisories

Ecosystem

GitHub Actions

56 known vulnerabilities.

Most affected packages

step-security/harden-runner 5 shivammathur/setup-php 2 pypa/gh-action-pypi-publish 2 SonarSource/sonarqube-scan-action 2 rlespinasse/github-slug-action 2 tj-actions/branch-names 2 tj-actions/changed-files 2 aquasecurity/trivy-action 2 google-github-actions/run-gemini-cli 1 OZI-Project/publish 1 canonical/get-workflow-version-action 1 actions/runner 1 wktk/conflibot 1 hashicorp/vault-action 1 atlassian/gajira-create 1 dawidd6/action-download-artifact 1 some-natalie/ghas-to-csv 1 lycheeverse/lychee-action 1 Tiryoh/actions-mkdocs 1 ultralytics/actions 1 anthropics/claude-code-action 1 afichet/openexr-viewer 1 gouef/githubtoplanguages 1 RageAgainstThePixel/setup-steamcmd 1 actions/download-artifact 1 SHAdd0WTAka/Zen-Ai-Pentest 1 xygeni/xygeni-action 1 kartverket/github-workflows 1 check-spelling/check-spelling 1 tj-actions/verify-changed-files 1 gradle/gradle-build-action 1 https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1 bullfrogsec/bullfrog 1 buildalon/setup-steamcmd 1 Azure/setup-kubectl 1 broadinstitute/cromwell 1 j178/prek-action 1 reviewdog/action-setup 1 njzjz/wenxian 1 super-linter/super-linter 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.6
    CVE-2026-46420 Public exploit

    setup-php: Command Injection in Repository-Derived PHP Version Resolution

    setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock t…

    shivammathur setup-php shivammathur/setup-php GitHub Actions
  • Critical 9.8
    CVE-2026-34243 Public exploit

    wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`

    wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potenti…

    njzjz wenxian njzjz/wenxian GitHub Actions
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI aquasecurity team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • High 8.7
    CVE-2026-31900 Public exploit

    Black's vulnerable version parsing leads to RCE in GitHub Action

    Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request co…

    psf black black black Debian Ubuntu PyPI GitHub Actions
  • Critical 9.1
    CVE-2025-54416 Public exploit

    tj-actions/branch-names Contains Command Injection Vulnerability

    tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action…

    tj-actions branch-names tj-actions/branch-names GitHub Actions
  • High 8.6
    CVE-2025-30066 Exploited Public exploit EPSS 72%

    tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…

    tj-actions changed-files tj-actions/changed-files GitHub Actions
    KEV Mar 18, 2025
  • Critical 9.8
    CVE-2023-50245 Public exploit

    OpenEXR-viewer memory overflow vulnerability

    OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.

    afichet openexr-viewer afichet/openexr-viewer GitHub Actions
  • Critical 9.9
    CVE-2021-32724 Public exploit

    check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack

    check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or `schedule`…

    check-spelling check-spelling check-spelling/check-spelling GitHub Actions