Vulnerability · Published Dec 26, 2022 · Assigned by VulDB

CVE-2021-4281Brave UX for-the-badge combine-prs.yml os command injection

Medium 4.6

In plain English

A medium-severity OS command injection in for-the-badge from Brave UX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)1.9%top 20.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Brave UX	for-the-badge	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.216842 vdb-entry
https://vuldb.com/?ctiid.216842 signature, permissions-required
https://github.com/BraveUX/for-the-badge/pull/165 issue-tracking
https://github.com/BraveUX/for-the-badge/commit/55b5a234c0fab935df5fb08365bc8fe9c37cf46b patch