Description
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| actions | toolkit | >= 2.0.0, < 2.1.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- unzip-stream 0.3.1 - Arbitrary File Write EDB-52276 · local · Apr 30, 2025
GitHub 1 repository
-
theMcSam/CVE-2024-42471-PoC ★ 0 · Apr 24, 2025
unzip-stream file write/overwrite vulnerability
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @actions/artifact | >= 2.0.0, < 2.1.2 | 2.1.2 | GHSA-6q32-hq47-5qq3 |