Skip to content
OpenAdvisories

Vendor

actions

6 known vulnerabilities.

Products

toolkit 4 http-client 1 runner 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.5
    CVE-2020-15228 Public exploit

    Environment Variable Injection in GitHub Actions

    In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands,…

    actions toolkit @actions/core npm