Description
kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the context of the workflow. Users should upgrade to at least version 2.7.5 to resolve the issue. As a workaround, review any pull requests from external users for malicious payloads before allowing them to trigger a build.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kartverket | github-workflows | < 2.7.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| GitHub Actions | kartverket/github-workflows | < 2.7.5 | 2.7.5 | GHSA-f9qj-7gh3-mhj4 |