CVE-2020-15228

CVE-2020-15228 describes a vulnerability in the @actions/core npm module (versions prior to 1.2.6) used in GitHub Actions, where untrusted data logged to stdout could be misinterpreted as commands, allowing modification of environment variables or the system path. This medium-severity vulnerability (CVSS 5.0) has a network attack vector and low attack complexity, potentially leading to unauthorized changes to workflow execution without direct impact on confidentiality or availability. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.