actions vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20222
3. 20241
4. 20251

Newest CVEs

• CVE-2025-5890

  actions toolkit glob internal-pattern.ts globEscape redos

  actions · toolkit

  Medium5.3
• CVE-2024-42471

  Arbitrary File Write via artifact extraction in actions/artifact

  actions · toolkit

  High7.3
• CVE-2022-39321

  GitHub Actions Runner vulnerable to Docker Command Escaping

  actions · runner

  High8.8
• CVE-2022-35954

  Delimiter injection vulnerability in @actions/core exportVariable

  actions · toolkit

  Medium5.0
• CVE-2020-15228

  Environment Variable Injection in GitHub Actions

  actions · toolkit

  Low3.5
• CVE-2020-11021

  HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client

  actions · http-client

  Medium6.3