CVE-2023-51664

CVE-2023-51664 is a critical command injection vulnerability affecting tj-actions/changed-files, a GitHub action used to retrieve files and directories, specifically versions prior to 41.0.0. This flaw allows an unauthenticated attacker to execute arbitrary code on the GitHub Runner and potentially exfiltrate secrets by injecting commands into changed filenames. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there are no known public exploits or active exploitation listed in KEV, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.