-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe handling of user-controlled input (github.head_ref) in a shell command. The removed step 'get-github-ref-name' in action.yml used direct substitution of github.head_ref in a bash script (refname="${{ github.head_ref || github.ref_name }}"), making it vulnerable to command injection. The patch replaced this with environment variable usage (env.GITHUB_HEAD_REF_RAW), which is treated as trusted input by GitHub Actions' context escaping rules. The removed bash script constitutes the vulnerable function as it directly executed untrusted input.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rlespinasse/github-slug-action | actions | >= 4.0.0, < 4.4.1 | 4.4.1 |