Github Slug Action
Approved changes feed: RSS · Atom
cpe:2.3:a:rlespinasse:github-slug-action:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Rlespinasse (72e89cca-d92a-59f4-bb0c-1268523b0a87) |
|---|---|
| Product | Github Slug Action (03577e63-2437-5bf6-a2f3-4af7957f5263) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-27581 |
vulnerable | 2026-06-08 05:57:42.072915 |
github-slug-action vulnerable to arbitrary code execution
HIGH (8.8)
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
Published: 2023-03-13T20:19:23.350Z
Updated: 2025-02-25T14:58:17.504Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.