[{"uuid":"GSA_kwCzR0hTQS00amh3LWM1M3ctdzVyN84ABFxY","url":"https://github.com/advisories/GHSA-4jhw-c53w-w5r7","title":"PipeCD Vulnerable to Privilege Escalation","description":"Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-03-21T18:31:35.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.0,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-53351","https://gist.github.com/HouqiyuA/948a808b8bd48b17b37a4d5e0b6fb005","https://github.com/pipe-cd/pipecd","https://pipecd.dev","https://github.com/advisories/GHSA-4jhw-c53w-w5r7"],"source_kind":"github","identifiers":["GHSA-4jhw-c53w-w5r7","CVE-2024-53351"],"repository_url":"https://github.com/pipe-cd/pipecd","blast_radius":1.0,"created_at":"2025-03-21T23:07:46.928Z","updated_at":"2026-10-16T06:07:37.827Z","epss_percentage":0.00495,"epss_percentile":0.40986,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00amh3LWM1M3ctdzVyN84ABFxY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00amh3LWM1M3ctdzVyN84ABFxY","packages":[{"ecosystem":"go","package_name":"github.com/pipe-cd/pipecd","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.49.0"}],"purl":"pkg:go/github.com%2Fpipe-cd%2Fpipecd"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00amh3LWM1M3ctdzVyN84ABFxY/related_packages","related_advisories":[]}]