duck-site vulnerabilities
1 known vulnerability in duck-site from Duck-organization. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
1vulnerabilities
1critical
0high
0exploited
9.5average CVSS score
Latest first
- 9.5 Critical severity
duck-site: Inclusion of Functionality from Untrusted Control Sphere
In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacker