actions

Products

Product	CVEs	Exploited	Latest
toolkit	4	–	Jun 9, 2025
http-client	1	–	Apr 29, 2020
runner	1	–	Oct 25, 2022

CVE-2025-5890 Medium 4.3 actions toolkit glob internal-pattern.ts globEscape redos 0.4%
CVE-2024-42471 High 7.3 Arbitrary File Write via artifact extraction in actions/artifact 3.2%
CVE-2022-39321 High 8.8 GitHub Actions Runner vulnerable to Docker Command Escaping 2.0%
CVE-2022-35954 Medium 5.0 Delimiter injection vulnerability in @actions/core exportVariable 0.7%
CVE-2020-15228 Low 3.5 Environment Variable Injection in GitHub Actions 1.5%
CVE-2020-11021 Medium 6.3 HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client 1.8%