CVE-2025-53546

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53546

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53546.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53546

Aliases

GHSA-h87r-5w74-qfm4

Published

2025-07-09T14:27:40.848Z

Modified

2026-04-10T05:32:11.007012Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Folo allows secrets exfiltration via `pull_request_target`

Details

Folo organizes feeds content into one timeline. Using pullrequesttarget on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUBTOKEN which has high privileges. GITHUBTOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-829"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53546.json"
}

References

Affected packages

Git / github.com/rssnext/folo

Affected ranges

Type: GIT
Repo: https://github.com/rssnext/folo
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

585c6a591440cd39f92374230ac5d65d7dd23d6a

Affected versions

v0.*

v0.0.1-alpha.1

v0.0.1-alpha.10

v0.0.1-alpha.11

v0.0.1-alpha.12

v0.0.1-alpha.13

v0.0.1-alpha.14

v0.0.1-alpha.15

v0.0.1-alpha.16

v0.0.1-alpha.17

v0.0.1-alpha.18

v0.0.1-alpha.19

v0.0.1-alpha.2

v0.0.1-alpha.20

v0.0.1-alpha.21

v0.0.1-alpha.22

v0.0.1-alpha.3

v0.0.1-alpha.4

v0.0.1-alpha.5

v0.0.1-alpha.6

v0.0.1-alpha.7

v0.0.1-alpha.8

v0.0.1-alpha.9

v0.0.1-internal.1

v0.1.0-beta.0

v0.1.1-beta.0

v0.1.1-beta.1

v0.1.2-beta.0

v0.2.0-beta.0

v0.2.0-beta.1

v0.2.0-beta.2

v0.2.1-beta.0

v0.2.2-beta.0

v0.2.3-beta.0

v0.2.5-beta.0

v0.2.6-beta.0

v0.2.7-beta.0

v0.2.8-beta.0

v0.2.9-beta.0

v0.3.0-beta.0

v0.3.1-beta.0

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.2-beta.0

v0.3.3-beta.0

v0.3.4-beta.0

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.5.0

v0.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53546.json"