CVE-2025-58371: Improper Neutralization of Special Elements used in an OS Command

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution RCE on the Actions runner...

Malicious code in actions-runner-admin (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8bf5c8993e97e4a8a3f91ab4b6b7618dc0f73864793854b4458516ece843a6db The OpenSSF Package Analysis project identified 'actions-runner-admin' @ 99.99.99 rubygems as malicious. It is considered malicious because: - T...

MAL-2025-46892 Malicious code in actions-runner-admin (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8bf5c8993e97e4a8a3f91ab4b6b7618dc0f73864793854b4458516ece843a6db The OpenSSF Package Analysis project identified 'actions-runner-admin' @ 99.99.99 rubygems as malicious. It is considered malicious because: - T...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: grafana-mimir, git-lfs, gitness, mkcert, harbor-registry, envoy-gateway, sonobuoy, hydra, traefik, step-ca, authservice, ollama, gptscript, gcsfuse, otel-cli, emissary, sftpgo-plugin-eventstore, crossplane-provider-aws-iam, tflint, nri-discovery-kubernetes,...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: grafana-mimir, git-lfs, gitness, mkcert, harbor-registry, envoy-gateway, sonobuoy, hydra, traefik, step-ca, authservice, ollama, gptscript, gcsfuse, otel-cli, emissary, sftpgo-plugin-eventstore, crossplane-provider-aws-iam, tflint, nri-discovery-kubernetes,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: age, grafana-mimir, git-lfs, gitness, karma, mkcert, harbor-registry, go-bindata, s5cmd, envoy-gateway, sonobuoy, authservice, gptscript, emissary, buildkitd, nri-elasticsearch, tflint, redka, crossplane-provider-azure-managedidentity, fq, temporal-server,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: age, grafana-mimir, git-lfs, gitness, karma, mkcert, harbor-registry, go-bindata, s5cmd, envoy-gateway, sonobuoy, authservice, gptscript, emissary, buildkitd, nri-elasticsearch, tflint, redka, crossplane-provider-azure-managedidentity, fq, temporal-server,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: grafana-mimir, cortex, gitness, kaniko, guac, harbor-registry, sftpgo-plugin-pubsub, crossplane-provider-azure, hydra, traefik, step-ca, chezmoi, amazon-cloudwatch-agent, pulumi, dgraph, atlantis, gitsign, ksops, gitea, argo-workflows, azcopy, zarf, buildkitd,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: age, git-lfs, gitness, karma, mkcert, harbor-registry, go-bindata, s5cmd, sonobuoy, nsc, gptscript, gcsfuse, emissary, sftpgo-plugin-eventstore, osv-scanner, tflint, redka, nri-discovery-kubernetes, neuvector-sigstore-interface, fq, descheduler, temporal-server,...

CVE-2022-39321

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: nri-kubernetes, kubernetes-event-exporter, metrics-server, logstash-exporter, policy-controller, prometheus-postgres-exporter-fips, crossplane-provider-aws-eks, thanos-operator, falcoctl, aws-efs-csi-driver, step, vault-k8s-fips, rekor, certificate-transparency-fips,...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, pulumi-kubernetes-operator, crossplane, crossplane-provider-aws-sqs, kubescape, pulumi-language-yaml, crossplane-provider-aws-kms, tkn, flux, policy-controller, pulumi-language-java, tekton-chains, crossplane-provider-aws-lambda,...

Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower

Impact This vulnerability only impacts versions v2 and lower. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs fs.chmodSynckubectlPath, 777 to set...

CVE-2022-46257

An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploi...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is a U.S. GitHub open source application. Provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions prior to 3.7. An attacker...

CVE-2022-46257: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploi...

CVE-2023-23939 Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower

Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This...

Command injection

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...