GHSA-gw8q-3x59-mjjx: tsParticles: Generated release notes can execute shell commands in the stable publish workflow
tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAWRELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUBTOKEN and write permissions. This issue is fixed in version 4.3.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tsParticlesto a version that resolves this vulnerability.Fixed in 4.3.2