Skip to content
Fencer Intel
medium —

GHSA-7f32-hm4h-w77q json

github-slug-action use of `set-env` Runner commands which are processed via stdout

published 2y ago modified 2y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact This GitHub Action use `set-env` runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w

### Patches The following versions use the recommended [Environment File Syntax](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files).

- 2.1.1 - 1.1.1

### Workarounds None, it is strongly suggested that you upgrade as soon as possible.

### For more information If you have any questions or comments about this advisory: * Open an issue in [rlespinasse/github-slug-action](https://github.com/rlespinasse/github-slug-action)

Patch / fix

  • github-actions rlespinasse/github-slug-action 1.1.1, 2.1.1

Is GHSA-7f32-hm4h-w77q in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
github-actions rlespinasse/github-slug-action
<1.1.1
>=2.0.0, <2.1.1
1.1.1
2.1.1

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.