@actions/core 注入漏洞

@actions/core is the core function of the npm package management tool for individual developers. This function is used for result, key, and log configuration. An injection vulnerability exists in @actions/core 1.9.0 and earlier, which stems from the use of a well-known delimiter in the...

CVE-2022-35954

The CVE-2022-35954 issue affects the GitHub Actions ToolKit, specifically core.exportVariable in @actions/core. The vulnerability arises from a well-known delimiter (GitHubActionsFileCommandDelimeter ) used to set environment variables via GITHUB_ENV, which can be exploited to break out of the in...

PT-2022-23055 · Github · @Actions/Core

Name of the Vulnerable Software and Affected Versions: @actions/core versions prior to v1.9.1 Description: The core.exportVariable function uses a well-known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that writ...