-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises from the insecure use of an attacker-controlled value (github.event.workflow_run.head_branch) directly in a shell command. The run step in the GitHub Actions workflow uses ${{ ... }} interpolation to inject the branch name into the --branch argument of a Python script. Since GitHub Actions evaluates expressions before shell execution, a malicious branch name containing shell metacharacters (e.g., $(...) or backticks) could lead to arbitrary command execution. The remediation uses an environment variable to bypass expression injection, confirming the root cause was improper handling of untrusted input in the workflow step.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| https://github.com/pytorch/pytorch/.github/actions/filter-test-configs | actions | < 2.0.1 |
GitHub ActionsGitHub ActionsOngoing coverage of React2Shell