Skip to content
OpenAdvisories

Vendor

actions

6 known vulnerabilities.

actions at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202510
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

toolkit 4 http-client 1 runner 1
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 4.3
    CVE-2025-5890

    actions toolkit glob internal-pattern.ts globEscape redos

    A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression c…

    actions toolkit
  • High 7.3
    CVE-2024-42471 Public exploit

    Arbitrary File Write via artifact extraction in actions/artifact

    actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExtern…

    actions toolkit @actions/artifact npm
  • High 8.8
    CVE-2022-39321

    GitHub Actions Runner vulnerable to Docker Command Escaping

    GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is…

    actions runner actions/runner GitHub Actions
  • Medium 5.0
    CVE-2022-35954

    Delimiter injection vulnerability in @actions/core exportVariable

    The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables.…

    actions toolkit @actions/core npm
  • Low 3.5
    CVE-2020-15228 Public exploit

    Environment Variable Injection in GitHub Actions

    In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands,…

    actions toolkit @actions/core npm
  • Medium 6.3
    CVE-2020-11021

    HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client

    Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an…

    actions http-client @actions/http-client npm