GitHub Advisoryadvisory · npm

GHSA-6q32-hq47-5qq3 @actions/artifact has an Arbitrary File Write via artifact extraction

HIGH Published 2024-09-03 Modified 2025-01-22 Official page ↗
Aliases
CVE-2024-42471
Ecosystem
npm
Packages
@actions/artifact
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2024-09-03

Affected packages

• npm @actions/artifact: >= 2.0.0, < 2.1.2 → fixed in 2.1.2

Description

Impact Versions of `actions/artifact` before 2.1.7 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Patches Upgrade to version 2.1.7 or higher. References • https://snyk.io/research/zip-slip-vulnerability • https://github.com/actions/toolkit/pull/1724 CVE CVE-2024-42471 Credits Justin Taft from Google

Related

Alias · CVE (1)

  • CVE-2024-42471 actions/artifact is the GitHub ToolKit for developing GitHub Actions. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References