Actions vulnerabilities
We track 2 vulnerabilities in Actions products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 2, 2024.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Actions vulnerabilities
- 7.5 High severity
toolkit: Improper Limitation of a Pathname to a Restricted Directory
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExterna
- 9.9 Critical severity
runner: Improper Neutralization of Special Elements used in an OS Command
GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is