PT-2025-42410

Summary There are three potential attacks of arbitrary code injection vulnerability in the composite action at action.yml . Details The GitHub Action variables inputs.prek-version, inputs.extra args, and inputs.extra-args can be used to execute arbitrary code in the context of the action. PoC yam...