lycheeverse vulnerabilities

Products

• lycheeverse/lychee-action 1

Latest lycheeverse CVEs

Newest publication first

1. CVE-2024-48908 lychee-action vulnerable to arbitrary code injection in composite action

   Published 2025-08-28

   Medium·CVSS 6.9 EPSS 0.37%

   lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.