fix-CVE-2020-15228

修复 CVE-2020-15228（Github-Actions 中的 set-env、add-path） 此脚本会修改你的 GitHub Actions 文件中的行。 你给它一个目录名，它会搜索所有扩展名为 ".sh" 或 ".yml" 的文件。 它能识别以下这些行： root@kitploit: echo ::set-env name=FOOBAR::$FOOBAR echo ::set-env name=FOOBAR::$FOOBAR echo "::set-env name=FOOBAR::$FOOBAR" echo "::set-env name=FOOBAR::$FOOBAR...

CVE-2020-15228

creationtimestamp| type| source ---|---|--- 2024-11-14 06:07:13+00:00| seen| MISP/f4c18b78-4cca-4231-b957-1490787689a1 2026-07-29 12:01:07+00:00| seen| https://t.me/hnbestcomments/6341 2026-07-30 00:01:47+00:00| seen| https://t.me/hnbestcomments/6341 2026-08-01 08:00:04+00:00| seen|...

CVE-2020-15228

CVE-2020-15228 affects the npm package @actions/core (pre-1.2.6). The vulnerability stems from addPath and exportVariable communicating with the Actions Runner via stdout in a specific format, allowing untrusted workflow data logged to stdout to modify PATH or environment variables. Mitigation: u...

@atlantis-lab/actl (>=0.4.0, <=0.4.37), @atlantis-lab/actl-check (>=0.1.0, <=0.4.18) +23 more potentially affected by CVE-2020-15228 via @actions/core (>=1.0.0, <=1.2.5)

@actions/core NPM version =1.0.0, =0.4.0, =0.1.0, =0.0.1, =0.1.0, =0.0.0-canary.6527017, =0.0.0-d99f4ac.0, =0.0.5, =3.5.2, =0.1.22, =0.1.1, =0.1.1, =0.1.1, =1.0.0, =1.4.3 - bugcatcher-github-action 0.1.0 and more Source cves: CVE-2020-15228 Source advisory: OSV:GHSA-MFWH-5M23-J46W...