GitHub Advisoryadvisory · GitHub Actions
GHSA-7f32-hm4h-w77q github-slug-action use of `set-env` Runner commands which are processed via stdout
MEDIUM
Official page ↗
- Ecosystem
- GitHub Actions
- Packages
- rlespinasse/github-slug-action
- Severity
- Moderate
- Reviewed
- 2024-02-03
Affected packages
• GitHub Actions rlespinasse/github-slug-action: < 1.1.1 → fixed in 1.1.1
• GitHub Actions rlespinasse/github-slug-action: >= 2.0.0, < 2.1.1 → fixed in 2.1.1
Description
Impact
This GitHub Action use `set-env` runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w
Patches
The following versions use the recommended Environment File Syntax.
• 2.1.1
• 1.1.1
Workarounds
None, it is strongly suggested that you upgrade as soon as possible.
For more information
If you have any questions or comments about this advisory:
• Open an issue in rlespinasse/github-slug-action