Ecosystem
GitHub Actions
56 known vulnerabilities.
Most affected packages
step-security/harden-runner 5
shivammathur/setup-php 2
pypa/gh-action-pypi-publish 2
SonarSource/sonarqube-scan-action 2
rlespinasse/github-slug-action 2
tj-actions/branch-names 2
tj-actions/changed-files 2
aquasecurity/trivy-action 2
google-github-actions/run-gemini-cli 1
OZI-Project/publish 1
canonical/get-workflow-version-action 1
actions/runner 1
wktk/conflibot 1
hashicorp/vault-action 1
atlassian/gajira-create 1
dawidd6/action-download-artifact 1
some-natalie/ghas-to-csv 1
lycheeverse/lychee-action 1
Tiryoh/actions-mkdocs 1
ultralytics/actions 1
anthropics/claude-code-action 1
afichet/openexr-viewer 1
gouef/githubtoplanguages 1
RageAgainstThePixel/setup-steamcmd 1
actions/download-artifact 1
SHAdd0WTAka/Zen-Ai-Pentest 1
xygeni/xygeni-action 1
kartverket/github-workflows 1
check-spelling/check-spelling 1
tj-actions/verify-changed-files 1
gradle/gradle-build-action 1
https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1
bullfrogsec/bullfrog 1
buildalon/setup-steamcmd 1
Azure/setup-kubectl 1
broadinstitute/cromwell 1
j178/prek-action 1
reviewdog/action-setup 1
njzjz/wenxian 1
super-linter/super-linter 1
2 results · Clear filters · Feed
-
Low 2.7
Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`
StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables tha…
-
Low 3.9
Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower
Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action b…