GHSA-2487-9f55-2vg9
OZI-Project/ozi-publish Code Injection vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| GitHub Actions | OZI-Project/publish | >= 1.13.2, < 1.13.6 | 1.13.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code.
### Patches
This is patched in 1.13.6
### Workarounds
Downgrade to <1.13.2
### References
* [Understanding the Risk of Script Injections](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)
References
External links from the advisory. They lead to third-party sites.