{"id":"CVE-2022-35954","aliases":["EUVD-2022-6508","GHSA-7r3h-m5j6-3q42"],"status":"published","title":"Delimiter injection vulnerability in @actions/core exportVariable","description":"The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00704,"percentile":0.53594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-77"],"published":"2022-08-13T23:40:09Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"npm","package":"@actions/core","fixed_in":["1.9.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@actions/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@actions/core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.1"}]}]}],"products":[{"vendor":"actions","product":"toolkit"},{"vendor":"github","product":"toolkit"},{"vendor":"seagate","product":"toolkit"}],"references":[{"url":"https://github.com/actions/toolkit/security/advisories/GHSA-7r3h-m5j6-3q42","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/actions/toolkit/commit/4beda9cbc00ba6eefe387a937c21087ccb8ee9df","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35954","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7r3h-m5j6-3q42"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35954.json","tags":["advisory"]},{"url":"https://github.com/actions/toolkit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-35954","title":"Delimiter injection vulnerability in @actions/core exportVariable","description":"The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.","status":"published","published":"2022-08-13T23:40:09Z","modified":"2025-04-23T17:50:43.987Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:40.275153Z"}],"euvd":[{"id":"EUVD-2022-6508","description":"The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.","status":"published","published":"2022-08-13T23:40:09Z","modified":"2025-04-23T17:50:43Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:10.363195Z"}],"ghsa":[{"id":"GHSA-7r3h-m5j6-3q42","title":"@actions/core has Delimiter Injection Vulnerability in exportVariable","description":"## Impact\n\nThe `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author.\n\n## Patches\n\nUsers should upgrade to `@actions/core v1.9.1`.\n\n## Workarounds\n\nIf you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.\n\n## References\n\n[More information about setting-an-environment-variable in workflows](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable)\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [`actions/toolkit`](https://github.com/actions/toolkit/issues)\n","status":"published","published":"2022-08-18T19:01:36Z","modified":"2023-01-30T05:06:59Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-77"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-35954","description":"The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.","status":"published","published":"2022-08-15T11:21:39.04Z","modified":"2026-06-17T04:52:35.747Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-77","CWE-74"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"CVE-2022-35954","title":"Delimiter injection vulnerability in @actions/core exportVariable","description":"The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.","status":"published","published":"2022-08-13T23:40:09Z","modified":"2026-10-28T02:30:26.275843549Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-7r3h-m5j6-3q42","title":"@actions/core has Delimiter Injection Vulnerability in exportVariable","description":"## Impact\n\nThe `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author.\n\n## Patches\n\nUsers should upgrade to `@actions/core v1.9.1`.\n\n## Workarounds\n\nIf you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.\n\n## References\n\n[More information about setting-an-environment-variable in workflows](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable)\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [`actions/toolkit`](https://github.com/actions/toolkit/issues)\n","status":"published","published":"2022-08-18T19:01:36Z","modified":"2023-11-08T04:09:54.141459Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-77"],"updated_at":"2026-11-02T15:46:41.349637Z"}]}}