GitHub Advisoryadvisory · GitHub Actions
GHSA-cxww-7g56-2vh6 @actions/download-artifact has an Arbitrary File Write via artifact extraction
HIGH
Official page ↗
- Ecosystem
- GitHub Actions
- Packages
- actions/download-artifact
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2024-09-03
Affected packages
• GitHub Actions actions/download-artifact: >= 4.0.0, < 4.1.3 → fixed in 4.1.3
Description
Impact
Versions of `actions/download-artifact` before 4.1.3 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.
Patches
Upgrade to version 4.1.3 or higher. Alternatively use 'v4' tag which points to the latest and secure version.
References
• https://snyk.io/research/zip-slip-vulnerability
• https://github.com/actions/download-artifact/releases/tag/v4.1.3
• https://github.com/actions/download-artifact/pull/299
CVE
CVE-2024-42471
Credits
Justin Taft from Google
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6 web
- https://github.com/actions/download-artifact package
- https://github.com/actions/download-artifact/releases/tag/v4.1.3 web
- https://github.com/advisories/GHSA-6q32-hq47-5qq3 advisory
- https://snyk.io/research/zip-slip-vulnerability web