The vulnerability of the canonical/get-workflow-version-action component of the platform for automating GitHub Actions work processes allows a hacker to gain access to the secret GITHUB_TOKEN.

The vulnerability of the “canonical/get-workflow-version-action” component of the platform for automating GitHub Actions processes is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the...

CVE-2025-31479 canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output

canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the excepti...

get-workflow-version-action 日志信息泄露漏洞

get-workflow-version-action is a Canonical open source tool. A log information disclosure vulnerability exists in get-workflow-version-action versions prior to 1.0.1, which stems from the fact that the exception output may contain GITHUBTOKEN, which could lead to information disclosure...