-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actions/download-artifact | actions | >= 4.0.0, < 4.1.3 | 4.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation during artifact extraction. The advisory references the Zip Slip vulnerability pattern (CWE-22) and links to fixes in @actions/artifact. The functions downloadArtifactInternal, downloadArtifactPublic, and streamExtractExternal in the @actions/artifact package (a dependency of actions/download-artifact) were identified as vulnerable. These functions handle artifact downloading and extraction without proper path sanitization, allowing path traversal. The confidence is high as the advisory explicitly mentions these functions and their fixes in the patched versions.