CVE-2023-49291

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49291
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49291.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-49291
Aliases
Published
2023-12-04T23:21:33.367Z
Modified
2026-02-23T02:51:47.666972Z
Severity
  • 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N CVSS Calculator
Summary
Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
Details

tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The tj-actions/branch-names GitHub Actions improperly references the github.event.pull_request.head.ref and github.head_ref context variables within a GitHub Actions run step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse GITHUB_TOKEN permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49291.json"
}
References

Affected packages

Git / github.com/tj-actions/branch-names

Affected ranges

Type
GIT
Repo
https://github.com/tj-actions/branch-names
Events
Introduced
4e532392367d7e4fb2f494f2d50c47562660cce5
Fixed
6c999acf206f5561e19f46301bb310e9e70d8815

Affected versions

v7.*
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49291.json"