Skip to content
OpenAdvisories

Vendor

actions

6 known vulnerabilities.

Products

toolkit 4 http-client 1 runner 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-5890

    actions toolkit glob internal-pattern.ts globEscape redos

    A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression c…

    actions toolkit
  • Medium 5.0
    CVE-2022-35954

    Delimiter injection vulnerability in @actions/core exportVariable

    The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables.…

    actions toolkit @actions/core npm
  • Medium 6.3
    CVE-2020-11021

    HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client

    Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an…

    actions http-client @actions/http-client npm