Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OZI-Project/ozi-publish Code Injection vulnerability
Vulnerability Description
The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. This is patched in 1.13.6. As a workaround, one may downgrade to a version prior to 1.13.2.
CVSS Information
N/A
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Vulnerability Title
OZI-publish 安全漏洞
Vulnerability Description
OZI-publish是OZI Project开源的一个项目。 OZI-publish 1.13.2版本至1.13.5版本存在安全漏洞，该漏洞源于不受信任的数据流入PR创建逻辑，可能导致执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A