CVE-2025-32953

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32953
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32953.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32953
Aliases
  • GHSA-gpjj-f76m-9x3q
Published
2025-04-18T20:42:46.655Z
Modified
2026-04-02T12:47:53.875902Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H CVSS Calculator
Summary
z80pack Vulnerable to Exposure of the GITHUB_TOKEN in Workflow Run Artifact
Details

z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU. In version 1.38 and prior, the makefile-ubuntu.yml workflow file uses actions/upload-artifact@v4 to upload the z80pack-ubuntu artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in your repository. This issue has been fixed in commit bd95916.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32953.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/udo-munk/z80pack

Affected ranges

Type
GIT
Repo
https://github.com/udo-munk/z80pack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1e06c2fe498ca772002b5c4f6f9e3085061e47da
Type
GIT
Repo
https://github.com/udo-munk/z80pack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
836c2e37b54f86bb4bed9e1406b67e52aa52308d
Type
GIT
Repo
https://github.com/udo-munk/z80pack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
95535987d690bd20849fbf143f267283f0e2db91
Type
GIT
Repo
https://github.com/udo-munk/z80pack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bd9591615ae7b1e6229aa60a485447441c4a0c15

Affected versions

1.*
1.36
1.37
1.38

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32953.json"