CVE-2022-35954: Delimiter injection vulnerability in @actions/core exportVariable
The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The core.exportVariable function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the GITHUBENV file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to @actions/core v1.9.1. If you are unable to upgrade the @actions/core package, you can modify your action to ensure that any user input does not contain the delimiter GitHubActionsFileCommandDelimeter before calling core.exportVariable.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-35954?
CVE-2022-35954 is a vulnerability in the GitHub Actions Toolkit that allows attackers to assign values to arbitrary variables by breaking out of a specific variable using a well-known delimiter.
What is the severity of CVE-2022-35954?
CVE-2022-35954 has a severity of medium with a severity value of 5.
What software versions are affected by CVE-2022-35954?
The affected software version for CVE-2022-35954 is GitHub Toolkit 1.9.1 (Node.js).
How can I fix CVE-2022-35954?
To fix CVE-2022-35954, update to a version of GitHub Toolkit above 1.9.1.
Are there any references available for CVE-2022-35954?
Yes, you can find additional information about CVE-2022-35954 in the GitHub Advisory GHSA-7r3h-m5j6-3q42.