Skip to content

github-slug-action use of `set-env` Runner commands which are processed via stdout

Moderate severity GitHub Reviewed Published Oct 7, 2020 in rlespinasse/github-slug-action • Updated Feb 3, 2024

Package

actions rlespinasse/github-slug-action (GitHub Actions)

Affected versions

<= 1.1.0
>= 2.0.0, <= 2.1.0

Patched versions

1.1.1
2.1.1

Description

Impact

This GitHub Action use set-env runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w

Patches

The following versions use the recommended Environment File Syntax.

  • 2.1.1
  • 1.1.1

Workarounds

None, it is strongly suggested that you upgrade as soon as possible.

For more information

If you have any questions or comments about this advisory:

References

@rlespinasse rlespinasse published to rlespinasse/github-slug-action Oct 7, 2020
Published to the GitHub Advisory Database Feb 3, 2024
Reviewed Feb 3, 2024
Last updated Feb 3, 2024

Severity

Moderate

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-7f32-hm4h-w77q

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.