Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

actions Security Advisories

Loading...
Moderate
GSA_kwCzR0hTQS03ZjMyLWhtNGgtdzc3cc4AA5Cs
github-slug-action use of `set-env` Runner commands which are processed via stdout
Ecosystems: actions
Packages: rlespinasse/github-slug-action
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 3 months ago
High
GSA_kwCzR0hTQS1naG0yLXJxOHEtd3JoY84AA4Jn
Potential Actions command injection in output filenames (GHSL-2023-275)
Ecosystems: actions
Packages: tj-actions/verify-changed-files
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 4 months ago
High
GSA_kwCzR0hTQS1tY3BoLW0yNWotOGo2M84AA4Jm
tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271)
Ecosystems: actions
Packages: tj-actions/changed-files
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 4 months ago
Critical
GSA_kwCzR0hTQS05OWpnLXIzZjQtcnB4as4AA3ss
memory overflow vulnerability in OpenEXR-viewer
Ecosystems: actions
Packages: afichet/openexr-viewer
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 4 months ago
Critical
GSA_kwCzR0hTQS04djh3LXY4eGctNzlyZs4AA3lB
tj-actions/branch-names's Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
Ecosystems: actions
Packages: tj-actions/branch-names
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS1odzZyLWc4Z2otMjk4N84AA1lL
Actions expression injection in `filter-test-configs` (`GHSL-2023-181`)
Ecosystems: actions
Packages: https://github.com/pytorch/pytorch/.github/actions/filter-test-configs
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 8 months ago
High
GSA_kwCzR0hTQS1oM3FyLTM5ajktNHI1ds4AAzCh
Data written to GitHub Actions Cache may expose secrets
Ecosystems: actions
Packages: gradle/gradle-build-action
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 12 months ago
High
GSA_kwCzR0hTQS1yZzNxLXByZjgtcXhtcM4AAy86
Arbitrary command injection in embano1/wip
Ecosystems: actions
Packages: embano1/wip
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: 12 months ago
High
GSA_kwCzR0hTQS02cTRtLTc0NzYtOTMyd84AAyEx
github-slug-action vulnerable to arbitrary code execution
Ecosystems: actions
Packages: rlespinasse/github-slug-action
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: about 1 year ago
Low
GSA_kwCzR0hTQS1wNzU2LXJmeGgteDYzaM4AAx-a
Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower
Ecosystems: actions
Packages: Azure/setup-kubectl
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: about 1 year ago
High
GSA_kwCzR0hTQS0yYzZtLTZncWgtNnFnM84AAvie
Docker Command Escaping in the GitHub Actions Runner
Ecosystems: actions
Packages: actions/runner
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: over 1 year ago
High
GSA_kwCzR0hTQS1mOXFqLTdnaDMtbWhqNM4AAvcr
run-terraform allows for RCE via terraform plan
Ecosystems: actions
Packages: kartverket/github-workflows
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: over 1 year ago
Critical
GSA_kwCzR0hTQS00eHF4LXBxcGotOWZxd84AAvMB
gajira-create GitHub action vulnerable to arbitrary code execution
Ecosystems: actions
Packages: atlassian/gajira-create
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS02MzRwLTkzaDktOTJ2aM4AAu2Z
ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File
Ecosystems: actions
Packages: some-natalie/ghas-to-csv
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: over 1 year ago
Critical
GSA_kwCzR0hTQS1nODZnLWNobTgtN3IycM4AAtvI
check-spelling workflow vulnerable to token leakage via symlink attack
Ecosystems: actions
Packages: check-spelling/check-spelling
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: over 1 year ago
High
GSA_kwCzR0hTQS00bWd2LW01Y20tZjloN84AAobT
Vault GitHub Action did not correctly mask multi-line secrets in output
Ecosystems: actions
Packages: hashicorp/vault-action
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: almost 2 years ago
Statistics
Advisories: 17,470
Packages: 8,115
Repositories: 15
Ecosystems: 12
Filter by Severity
Moderate 7,470 High 6,100 Critical 2,660 Low 958
Filter by Ecosystem
maven 5,492 npm 3,496 pypi 3,463 packagist 3,213 go 1,828 nuget 1,388 rubygems 812 cargo 772 swift 31 hex 29 actions 16 pub 8
Filter by Package
rlespinasse/github-slug-action 2 tj-actions/verify-changed-files 1 afichet/openexr-viewer 1 tj-actions/branch-names 1 https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1 Azure/setup-kubectl 1 atlassian/gajira-create 1 check-spelling/check-spelling 1 hashicorp/vault-action 1 kartverket/github-workflows 1 actions/runner 1 gradle/gradle-build-action 1 embano1/wip 1 some-natalie/ghas-to-csv 1 tj-actions/changed-files 1
Filter by Repository
https://github.com/rlespinasse/github-slug-action 2 https://github.com/tj-actions/verify-changed-files 1 https://github.com/tj-actions/changed-files 1 https://github.com/tj-actions/branch-names 1 https://github.com/some-natalie/ghas-to-csv 1 https://github.com/pytorch/pytorch 1 https://github.com/kartverket/github-workflows 1 https://github.com/hashicorp/vault-action 1 https://github.com/gradle/gradle-build-action 1 https://github.com/embano1/wip 1 https://github.com/check-spelling/check-spelling 1 https://github.com/Azure/setup-kubectl 1 https://github.com/atlassian/gajira-create 1 https://github.com/afichet/openexr-viewer 1 https://github.com/actions/runner 1