CVE-2023-52137 is a command injection vulnerability affecting the tj-actions/verify-changed-files GitHub Action, where specially crafted filenames containing special characters can lead to arbitrary code execution on the GitHub Runner. This high-severity vulnerability (CVSS 8.8) allows an attacker to potentially steal secrets like GITHUB_TOKEN if the action's output is used unsafely in a 'run' block. While no active exploitation or public exploit code is reported, and community discussion is minimal, the potential for high impact on confidentiality, integrity, and availability is significant. The vulnerability has been patched in versions 17 and 17.0.0 by enabling safe_output by default.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 17.0.0CPE matchmatch criteria | cpe:2.3:a:tj-actions:verify-changed-files:*:*:*:*:*:github:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.