org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-9678 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-6734 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-22036 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

Internet Bug Bounty: Electron CVE-2022-35954 Delimiter Injection Vulnerability in exportVariable

Describe the summary: The Electron Website provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write...

GHSA-7R3H-M5J6-3Q42 @actions/core has Delimiter Injection Vulnerability in exportVariable

Impact The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the GITHUBENV file may cause the path or other environment variables to be...

@atlantis-lab/actl (>=0.4.0, <=0.4.37), @atlantis-lab/actl-check (>=0.1.0, <=0.4.37) +62 more potentially affected by CVE-2022-35954 via @actions/core (>=1.0.0, <=1.9.0)

@actions/core NPM version =1.0.0, =0.4.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =2.3.0, =0.1.0, =0.0.0-canary.6527017, =0.0.0-d99f4ac.0, =0.0.5, =2.0.0, =3.5.2, =1.0.0, =0.1.0, =0.1.1 and more Source cves: CVE-2022-35954 Source advisory: OSV:GHSA-7R3H-M5J6-3Q42...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

@actions/core 注入漏洞

@actions/core is the core function of the npm package management tool for individual developers. This function is used for result, key, and log configuration. An injection vulnerability exists in @actions/core 1.9.0 and earlier, which stems from the use of a well-known delimiter in the...

CVE-2022-35954 Delimiter injection vulnerability in @actions/core exportVariable

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

CVE-2022-35954 Delimiter injection vulnerability in @actions/core exportVariable

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values t...

CVE-2020-15228

In the @actions/core npm module before version 1.2.6,addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment...

CVE-2020-15228

In the @actions/core npm module before version 1.2.6,addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment...

Design/Logic Flaw

In the @actions/core npm module before version 1.2.6,addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment...

GHSA-MFWH-5M23-J46W Environment Variable Injection in GitHub Actions

Impact The @actions/core npm module addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment variables being modifie...

@atlantis-lab/actl (>=0.4.0, <=0.4.37), @atlantis-lab/actl-check (>=0.1.0, <=0.4.18) +23 more potentially affected by CVE-2020-15228 via @actions/core (>=1.0.0, <=1.2.5)

@actions/core NPM version =1.0.0, =0.4.0, =0.1.0, =0.0.1, =0.1.0, =0.0.0-canary.6527017, =0.0.0-d99f4ac.0, =0.0.5, =3.5.2, =0.1.22, =0.1.1, =0.1.1, =0.1.1, =1.0.0, =1.4.3 - bugcatcher-github-action 0.1.0 and more Source cves: CVE-2020-15228 Source advisory: OSV:GHSA-MFWH-5M23-J46W...