Description
The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. This is patched in 1.13.6. As a workaround, one may downgrade to a version prior to 1.13.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OZI-Project | publish | >= 1.13.2, < 1.13.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| GitHub Actions | OZI-Project/publish | >= 1.13.2, < 1.13.6 | 1.13.6 | GHSA-2487-9f55-2vg9 |