-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tj-actions/changed-files | actions | < 41 | 41 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient output sanitization when handling filenames containing special characters. The key evidence is in the commit diff showing the addition of a 'safe_output' parameter and modifications to the setOutput function in src/utils.ts. The patched code adds regex replacement (/[$()`|&;]/g) to escape dangerous characters specifically for bash environments. This function is directly responsible for writing outputs that get interpolated into GitHub Actions run steps, making it the root cause when used without proper sanitization.
This issue may lead to arbitrary command execution in the GitHub Runner.
A new safe_output input would be enabled by default and return filename paths escaping special characters like ;, ` (backtick), $, (), etc for bash environments.
A safe recommendation of using environment variables to store unsafe outputs.
- name: List all changed files
env:
ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
run: |
for file in "$ALL_CHANGED_FILES"; do
echo "$file was changed"
done
A Semantic Attack on Google Gemini - Read the Latest Research