Description
A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| actions | toolkit | 0.5.0 | — |
References
- VDB-311661 | actions toolkit glob internal-pattern.ts globEscape redos vdb-entry technical-description
- VDB-311661 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #585727 | @actions @actions/glob 0.5.0 Inefficient Regular Expression Complexity third-party-advisory
- https://github.com/actions/toolkit/pull/2057 issue-tracking