What is CVE-2024-48908?

CVE-2024-48908 is a vulnerability in Lycheeverse Lychee-Action, classified under Code Injection. Published 2025-08-28.

Is CVE-2024-48908 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Lycheeverse Lychee-Action

CVE-2024-48908

lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.004 (28.5th percentile) — read the EPSS interpretation.

Affected products

Lycheeverse Lychee-action — versions < 2.0.2

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-48908?: CVE-2024-48908 is a vulnerability in Lycheeverse Lychee-Action, classified under Code Injection. Published 2025-08-28.
Is CVE-2024-48908 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.