actions @actions/http-client vulnerabilities

Latest actions @actions/http-client CVEs

Newest publication first

1. CVE-2020-11021 HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client

   Published 2020-04-29

   High·CVSS 7.5 EPSS 1.8%

   Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.