Improper Input Validation Affecting @actions/core package, versions <1.9.1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-ACTIONSCORE-2980270
- published 14 Aug 2022
- disclosed 14 Aug 2022
- credit Juho Nurminen
Introduced: 14 Aug 2022
CVE-2022-35954 Open this link in a new tabHow to fix?
Upgrade @actions/core to version 1.9.1 or higher.
Overview
@actions/core is a package that provides core functions for setting results, logging, registering secrets and exporting variables across actions.
Affected versions of this package are vulnerable to Improper Input Validation via the core.exportVariable function which uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables.
Workaround
Modify your action to ensure that any user input does not contain the delimiter _GitHubActionsFileCommandDelimeter_ before calling core.exportVariable.