dawidd6 vulnerabilities

Products

• dawidd6/action-download-artifact 1

Latest dawidd6 CVEs

Newest publication first

1. GHSA-5xr6-xhww-33m4 Artifact poisoning vulnerability in action-download-artifact v5 and earlier

   Published 2024-11-25

   High·CVSS 8.7

   Summary In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables)...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.