Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Folo allows secrets exfiltration via `pull_request_target`
Vulnerability Description
Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability Type
从非可信控制范围包含功能例程
Vulnerability Title
Folo 安全漏洞
Vulnerability Description
Folo是RSSNext开源的一个信息聚合工具。 Folo存在安全漏洞，该漏洞源于GitHub Actions工作流使用pull_request_target，可能导致权限提升。
CVSS Information
N/A
Vulnerability Type
N/A