CVE-2025-61584: serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow
serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pullrequest.head.repo.cloneurl and github.headref, to a command in the runner. Due to the action using the pullrequesttarget trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61584?
CVE-2025-61584 is classified as a high severity vulnerability due to its potential for exploitation via untrusted input processing.
How do I fix CVE-2025-61584?
To fix CVE-2025-61584, upgrade serverless-dns to version 0.1.31 or later where the unsafe interpolation issue has been resolved.
What software is affected by CVE-2025-61584?
CVE-2025-61584 affects RethinkDNS serverless-dns versions up to and including 0.1.30.
What type of vulnerability is CVE-2025-61584?
CVE-2025-61584 is an input validation vulnerability in the GitHub Action pr.yml that leads to unsafe interpolation of untrusted input.
Can CVE-2025-61584 be exploited remotely?
Yes, CVE-2025-61584 can be potentially exploited remotely, given its nature as a serverless function processing untrusted input.