Executive brief
GitHub Actions is a continuous integration/continuous deployment (CI/CD) automation platform used to build, test, and deploy code. The @actions/core toolkit module allows workflows to modify the system environment and PATH through stdout commands. If a workflow logs untrusted data to stdout, an attacker can inject malicious commands to modify environment variables or PATH settings, potentially redirecting code execution or exposing secrets stored in the environment.
Technical details
The vulnerability is an improper input validation / command injection flaw in GitHub Actions' @actions/core npm module. The addPath and exportVariable functions communicate with the Actions Runner by generating formatted strings written to stdout. When workflows log untrusted data to stdout (e.g., user input, external API responses), an attacker can craft input matching the expected command format to invoke set-env or add-path commands outside the workflow author's control. This allows arbitrary modification of environment variables and PATH, which can lead to execution of attacker-controlled code or disclosure of secrets. The issue affects @actions/core versions prior to 1.2.6, which includes a fix and enforces the newer Environment File Syntax for setting variables and paths.
Affected products
- GitHub @actions/core before 1.2.6
Timeline
- 2020-10-01: disclosed: CVE-2020-15228 and GHSA-mfwh-5m23-j46w published
- 2020-10-01: patched: Fixed in @actions/core v1.2.6