CVE-2021-32724

CVE-2021-32724 is a critical vulnerability in the check-spelling GitHub Action, affecting repositories configured to trigger on pull_request_target or schedule. An attacker can craft a malicious Pull Request to expose the GITHUB_TOKEN, enabling unauthorized commits and potential exfiltration of repository secrets. With a CVSS score of 9.9 (CRITICAL), this vulnerability has a low attack complexity and allows for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.