Actions
6 CVEs across 3 Actions products. Browse Actions vulnerabilities, severities, and proof-of-concept exploits.
Actions products with known CVEs
Actions CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-5890 | Medium | 4.3 | 2025-06-09 | A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/i… |
CVE-2024-42471 | High | 7.3 | 2024-09-02 | actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrar… |
CVE-2022-39321 | High | 8.8 | 2022-10-25 | GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job… |
CVE-2022-35954 | Medium | 5.0 | 2022-08-15 | The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that atta… |
CVE-2020-15228 | Low | 3.5 | 2020-10-01 | In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a… |
CVE-2020-11021 | Medium | 6.3 | 2020-04-29 | Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The c… |