Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Delimiter injection vulnerability in @actions/core exportVariable
Vulnerability Description
The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Vulnerability Title
@actions/core 注入漏洞
Vulnerability Description
@actions/core是个人开发者的npm包管理工具的核心函数。该函数用于结果、密钥、日志的配置。 @actions/core 1.9.0及之前版本存在注入漏洞，该漏洞源于core.exportVariable 函数使用一个众所周知的分隔符，攻击者利用该漏洞可以突破该特定变量并将值分配给其他任意变量。
CVSS Information
N/A
Vulnerability Type
N/A