Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

actions Security Advisories

Critical

GSA_kwCzR0hTQS00eHF4LXBxcGotOWZxd84AAvMB

gajira-create GitHub action vulnerable to arbitrary code execution
Ecosystems: actions
Packages: atlassian/gajira-create
Source: GitHub Advisory Database
Published: 8 months ago

Moderate

GSA_kwCzR0hTQS02MzRwLTkzaDktOTJ2aM4AAu2Z

ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File
Ecosystems: actions
Packages: some-natalie/ghas-to-csv
Source: GitHub Advisory Database
Published: 9 months ago

High

GSA_kwCzR0hTQS1yZzNxLXByZjgtcXhtcM4AAy86

Arbitrary command injection in embano1/wip
Ecosystems: actions
Packages: embano1/wip
Source: GitHub Advisory Database
Published: about 1 month ago

High

GSA_kwCzR0hTQS1oM3FyLTM5ajktNHI1ds4AAzCh

Data written to GitHub Actions Cache may expose secrets
Ecosystems: actions
Packages: gradle/gradle-build-action
Source: GitHub Advisory Database
Published: about 1 month ago

Critical

GSA_kwCzR0hTQS1nODZnLWNobTgtN3IycM4AAtvI

check-spelling workflow vulnerable to token leakage via symlink attack
Ecosystems: actions
Packages: check-spelling/check-spelling
Source: GitHub Advisory Database
Published: 10 months ago

High

GSA_kwCzR0hTQS00bWd2LW01Y20tZjloN84AAobT

Vault GitHub Action did not correctly mask multi-line secrets in output
Ecosystems: actions
Packages: hashicorp/vault-action
Source: GitHub Advisory Database
Published: about 1 year ago

High

GSA_kwCzR0hTQS0yYzZtLTZncWgtNnFnM84AAvie

Docker Command Escaping in the GitHub Actions Runner
Ecosystems: actions
Packages: actions/runner
Source: GitHub Advisory Database
Published: 8 months ago

High

GSA_kwCzR0hTQS1mOXFqLTdnaDMtbWhqNM4AAvcr

run-terraform allows for RCE via terraform plan
Ecosystems: actions
Packages: kartverket/github-workflows
Source: GitHub Advisory Database
Published: 8 months ago

Low

GSA_kwCzR0hTQS1wNzU2LXJmeGgteDYzaM4AAx-a

Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower
Ecosystems: actions
Packages: Azure/setup-kubectl
Source: GitHub Advisory Database
Published: 3 months ago

High

GSA_kwCzR0hTQS02cTRtLTc0NzYtOTMyd84AAyEx

github-slug-action vulnerable to arbitrary code execution
Ecosystems: actions
Packages: rlespinasse/github-slug-action
Source: GitHub Advisory Database
Published: 3 months ago

Filter by Severity

Moderate 5,145 High 4,556 Critical 2,099 Low 676

Filter by Ecosystem

maven 3,859 npm 3,126 pypi 2,605 packagist 1,696 go 1,243 nuget 939 rubygems 711 cargo 640 hex 21 actions 10 pub 5

Filter by Package

rlespinasse/github-slug-action 1 Azure/setup-kubectl 1 kartverket/github-workflows 1 actions/runner 1 hashicorp/vault-action 1 check-spelling/check-spelling 1 gradle/gradle-build-action 1 embano1/wip 1 some-natalie/ghas-to-csv 1 atlassian/gajira-create 1