GitHub Advisoryadvisory · GitHub Actions

GHSA-4xqx-pqpj-9fqw gajira-create GitHub action vulnerable to arbitrary code execution

CRITICAL Published 2022-10-07 Modified 2022-10-07 Official page ↗
Aliases
CVE-2020-14188
Ecosystem
GitHub Actions
Packages
atlassian/gajira-create
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed
2022-10-07

Affected packages

• GitHub Actions atlassian/gajira-create: < 2.0.1 → fixed in 2.0.1

Description

Impact An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. Patches This issue is patched in gajira-create version 2.0.1. Workarounds There are no known workarounds. References GitHub Security Lab advisory GHSL-2020-172

Related

Alias · CVE (1)

  • CVE-2020-14188 The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary… vulnerability

References