GHSA-7f32-hm4h-w77q
github-slug-action use of `set-env` Runner commands which are processed via stdout
Impact
This GitHub Action use set-env runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w
Patches
The following versions use the recommended Environment File Syntax.
- 2.1.1
- 1.1.1
Workarounds
None, it is strongly suggested that you upgrade as soon as possible.
For more information
If you have any questions or comments about this advisory:
- Open an issue in rlespinasse/github-slug-action
What each source reports
GitHub AdvisoriesNo score
github-slug-action use of `set-env` Runner commands which are processed via stdout
Impact
This GitHub Action use set-env runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w
Patches
The following versions use the recommended Environment File Syntax.
- 2.1.1
- 1.1.1
Workarounds
None, it is strongly suggested that you upgrade as soon as possible.
For more information
If you have any questions or comments about this advisory:
- Open an issue in rlespinasse/github-slug-action
- Record
GHSA-7f32-hm4h-w77q- Updated
- 2026-11-02
OSVNo score
github-slug-action use of `set-env` Runner commands which are processed via stdout
Impact
This GitHub Action use set-env runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w
Patches
The following versions use the recommended Environment File Syntax.
- 2.1.1
- 1.1.1
Workarounds
None, it is strongly suggested that you upgrade as soon as possible.
For more information
If you have any questions or comments about this advisory:
- Open an issue in rlespinasse/github-slug-action
- Record
GHSA-7f32-hm4h-w77q- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rlespinasse/github-slug-actionGitHub Actions | through 1.1.0 | 1.1.1 |
rlespinasse/github-slug-actionGitHub Actions | 2.0.0 to 2.1.0 | 2.1.1 |
rlespinasse/github-slug-actionGitHub Actions | before 1.1.1 | 1.1.1 |
rlespinasse/github-slug-actionGitHub Actions | 2.0.0 up to 2.1.1 | 2.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-7f32-hm4h-w77q is a vulnerability with no CVSS score yet in rlespinasse/github-slug-action, published February 3, 2024. No source lists public exploit code. Fixed in rlespinasse/github-slug-action 1.1.1.