gha-lab-b1fe4918c0

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of AdeptLanguage/Adept at commit...

Adept Workflow Code Execution

The vulnerability of the Adept Workflow programming language is related to insufficient protection of registration data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

adept-ai (>=0.2.0, <=0.2.3), agenty (>=0.2.0, <=0.2.1) +73 more potentially affected by CVE-2026-25580 via pydantic-ai-slim (>=0.0.26, <=1.55.0)

pydantic-ai-slim PYPI version =0.0.26, =0.2.0, =0.2.0, =0.1.4a1, =0.1.0, =0.3.0, =0.0.2, =0.1.0, =0.1.2, =0.1.1a0, =0.1.11, =0.0.174, =0.1.0, =0.3.0 and more Source cves: CVE-2026-25580 Source advisory: GHSA-2JRP-274C-JHV3...

EUVD-2025-14690

Malicious code in bioql PyPI...

MAL-2025-36034 Malicious code in test-mlw2-primp-adept (npm)

The package test-mlw2-primp-adept was found to contain malicious code...

Malicious code in test-mlw2-primp-adept (npm)

The package test-mlw2-primp-adept was found to contain malicious code...

CVE-2025-32958

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file...

CVE-2025-32958

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file...

CVE-2025-32958

Adept (prior to commit a1a41b7) exposed the GITHUB_TOKEN via the mac-standalone artifact created by remoteBuild.yml using actions/upload-artifact@v4. The artifact was a zip of the current directory that included the generated .git/config containing the run’s token, enabling an attacker to extract...

CVE-2025-32958 Adept exposed the GITHUB_TOKEN in workflow run artifact

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file...

CVE-2025-32958 Adept exposed the GITHUB_TOKEN in workflow run artifact

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file...

CVE-2025-32958 Adept exposed the GITHUB_TOKEN in workflow run artifact

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file...

PT-2025-17465

Name of the Vulnerable Software and Affected Versions Adept versions prior to commit a1a41b7 Description The issue concerns the exposure of the GITHUB TOKEN in the Adept language workflow. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the...

Adept information leakage vulnerability

Adept is a programming language open-sourced by AdeptLanguage. An information disclosure vulnerability exists in versions prior to Adept a1a41b7, which stems from the remoteBuild.yml workflow file potentially disclosing GITHUBTOKEN, which could lead to the push of malicious code...

CVE-2025-32958: Exposure of Sensitive Information to an Unauthorized Actor

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file...

com.bbn.adept:adept-api (>=2.7.3, <=2.7.4), com.bbn.adept:adept-kb (>=2.7.3, <=2.7.4) +10 more potentially affected by CVE-2021-44550 via edu.stanford.nlp:stanford-corenlp (3.7.0)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.bbn.adept:adept-api =2.7.3, =2.7.3, =2.7.3, =0.7.0, =1.0.1, =3.1, =0.1, =1.0, =1.2 Source...

com.bbn.adept:adept-api (>=2.7.3, <=2.7.4), com.bbn.adept:adept-kb (>=2.7.3, <=2.7.4) +10 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.7.0)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.bbn.adept:adept-api =2.7.3, =2.7.3, =2.7.3, =0.7.0, =1.0.1, =3.1, =0.1, =1.0, =1.2 Source...

adeptinstitute.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1001715 Security Researcher Elicx Helped patch 30 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting adeptinstitute.com website and its users. Following...

marketing.adept-telecom.co.uk XSS vulnerability

Vulnerable URL: http://marketing.adept-telecom.co.uk/acton/fs/blocks/showLandingPage/a/4869/p/p-0006/t/page/fm/0?s=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...

ebayla.txt

http://www.because-we-can.com/ebayla/ THE EBAYLA BUG AND HOW TO PROTECT YOURSELF This page describes a security problem that Blue Adept discovered with eBay's on-line auctions on March 31, 1999 realaudio interview. The security hole allows eBay users to easily steal the passwords of other eBay...