CVE-2023-30628 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow

🗓️ 24 Apr 2023 21:17:32Reported by GoogleType

osv🔗 osv.dev👁 15 Views

Kiwi TCMS test management system v12.2 and prior is vulnerable to command injection via untrusted `github.head_ref` field in `changelog.yml` workflow, allowing attacker-controlled value and write-access to the repository. Mitigated in latest commits

Reporter	Title	Published	Views	Family All 13
CNNVD	Kiwi TCMS 操作系统命令注入漏洞	24 Apr 202300:00	–	cnnvd
CNVD	Kiwi TCMS Operating System Command Injection Vulnerability	27 Apr 202300:00	–	cnvd
CVE	CVE-2023-30628	24 Apr 202321:17	–	cve
Cvelist	CVE-2023-30628 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow	24 Apr 202321:17	–	cvelist
EUVD	EUVD-2023-0290	3 Oct 202520:07	–	euvd
NVD	CVE-2023-30628	24 Apr 202322:15	–	nvd
OSV	PYSEC-2023-273	24 Apr 202322:15	–	osv
Prion	Command injection	24 Apr 202322:15	–	prion
Positive Technologies	PT-2023-22825 · Kiwi Tcms · Kiwitcms/Kiwi +1	24 Apr 202300:00	–	ptsecurity
PyPA	PYSEC-2023-273	24 Apr 202322:15	–	pypa

Source	Link
github	www.github.com/kiwitcms/Kiwi/blob/37bfb87696093ce0393160e2725949185cc0651d/.github/workflows/changelog.yml
securitylab	www.securitylab.github.com/research/github-actions-untrusted-input/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30628.json
github	www.github.com/kiwitcms/Kiwi/security/advisories/GHSA-cw6r-6ccx-5hwx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-30628
github	www.github.com/kiwitcms/Kiwi/commit/834c86dfd1b2492ccad7ebbfd6304bfec895fed2
github	www.github.com/kiwitcms/enterprise/commit/e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751

10 Apr 2026 04:57Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

EPSS0.12856