CVE-2024-48908
lychee-action vulnerable to arbitrary code injection in composite action
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
lychee-action vulnerable to arbitrary code injection in composite action
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
- Record
CVE-2024-48908- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-54925
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
- Record
EUVD-2024-54925- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-65rg-554r-9j5x
lychee link checking action affected by arbitrary code injection in composite action
Summary
There is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml.
Details
The GitHub Action variable inputs.lycheeVersion can be used to execute arbitrary code in the context of the action.
PoC
- uses: lycheeverse/lychee@v2
with:
lycheeVersion: $(printenv >> $GITHUB_STEP_SUMMARY && echo "v0.16.1")
The previous example will just print all the environment variables to the summary of the workflow, but an attacker could potentially use this vector to compromise the security of the target repository, even passing unnotice because the action will run normally.
Impact
Low
- Record
GHSA-65rg-554r-9j5x- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
- Record
CVE-2024-48908- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
lychee-action vulnerable to arbitrary code injection in composite action
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
- Record
CVE-2024-48908- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-65rg-554r-9j5x
lychee link checking action affected by arbitrary code injection in composite action
Summary
There is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml.
Details
The GitHub Action variable inputs.lycheeVersion can be used to execute arbitrary code in the context of the action.
PoC
- uses: lycheeverse/lychee@v2
with:
lycheeVersion: $(printenv >> $GITHUB_STEP_SUMMARY && echo "v0.16.1")
The previous example will just print all the environment variables to the summary of the workflow, but an attacker could potentially use this vector to compromise the security of the target repository, even passing unnotice because the action will run normally.
Impact
Low
- Record
GHSA-65rg-554r-9j5x- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lycheeverse/lychee-actionGitHub Actions |
before 2.0.2 | 2.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-48908 is a medium vulnerability (CVSS 6.9) in Lycheeverse Lychee-action, published August 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in lycheeverse/lychee-action 2.0.2.
References
github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x
nvd.nist.gov/vuln/detail/CVE-2024-48908