dedupe is vulnerable to secret exfiltration via `issue_comment`

dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issue_comment can be triggered using the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }}, which correspond to the branch of the PR manipulated by potentially malicious actors, and where untrusted code may be executed. Running untrusted code may lead to the exfiltration of GITHUB_TOKEN, which in this workflow has write permissions on most of the scopes - in particular the contents one - and could lead to potential repository takeover. This is fixed by commit 3f61e79.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Dedupe Python Library 操作系统命令注入漏洞

Dedupe Python Library是Dedupe.io开源的一个用于精确和可扩展的模糊匹配、去重的Python库。 Dedupe Python Library 存在操作系统命令注入漏洞，该漏洞源于.github/workflows/benchmark-bot.yml工作流中issue_comment触发执行不受信任代码，可能导致GITHUB_TOKEN泄露。

N/A

N/A