{"id":"CVE-2025-61584","aliases":["EUVD-2025-31664","GHSA-9g7x-737f-5xpc"],"status":"published","title":"serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow","description":"serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0037,"percentile":0.31319,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2025-09-30T00:12:23Z","modified":"2026-10-28T02:31:14Z","exploits":[{"source":"pocgithub","id":"pvharmo2/gha-lab-6904b2ccbe","title":"pvharmo2/gha-lab-6904b2ccbe","date":"2026-09-04","url":"https://github.com/pvharmo2/gha-lab-6904b2ccbe"}],"products":[{"vendor":"serverless-dns","product":"serverless-dns"}],"references":[{"url":"https://github.com/serverless-dns/serverless-dns/security/advisories/GHSA-9g7x-737f-5xpc","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/serverless-dns/serverless-dns/commit/c5537dd7f203c59f2b86d1e295c2371f3533946a","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61584.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61584","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-61584","title":"serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow","description":"serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.","status":"published","published":"2025-09-30T00:12:23.873Z","modified":"2025-09-30T13:33:56.83Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"critical","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-31664","description":"serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.","status":"published","published":"2025-09-30T00:12:23Z","modified":"2025-09-30T13:33:56Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"critical"}],"updated_at":"2026-11-02T20:31:38.096877Z"}],"nvd":[{"id":"CVE-2025-61584","description":"serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.","status":"published","published":"2025-09-30T11:37:41.91Z","modified":"2026-06-17T09:50:36.19Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:11:33.36253Z"}],"osv":[{"id":"CVE-2025-61584","title":"serverless-dns is vulnerable to Command Injection through pr.yml GitHub Action Workflow","description":"serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.","status":"published","published":"2025-09-30T00:12:23.873Z","modified":"2026-10-28T02:31:14.603002386Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:51.516975Z"}]}}