{"id":"GHSA-5xr6-xhww-33m4","aliases":[],"status":"published","title":"Artifact poisoning vulnerability in action-download-artifact v5 and earlier","description":"### Summary\n\nIn versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.\n\nUsers should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set `allow_forks: false` to disable searching forks for artifacts.\n\n### Details\n\nGitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the \"latest\" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream. \n\nBecause any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):\n\n1. Repository `alice/foo` runs `build.yml`, producing `build.exe`\n2. Repository `alice/foo` runs `publish.yml`, which uses `action-download-artifact@v5` to retrieve the latest `build.exe` from `build.yml`\n\nTo compromise `publish.yml` in this scenario, Mallory forks `alice/foo` to `mallory/foo`, and then modifies `build.yml` to produce a compromised `build.exe`. Mallory can then repeatedly trigger their copy of `build.yml` to ensure that their compromised `build.exe` is always the latest artifact, meaning that Alice's `publish.yml` will retrieve it.\n\nAdditional details on this vulnerability can be found in this blog post from 2022:\n\n* https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust\n\n### Impact\n\nThis vulnerability impacts all repositories on GitHub that use `action-download-artifacts@v5` or older and do **not** disable `allow_forks: true`, which is the default.\n\nIf a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as `push` or `pull_request_target`).","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-349"],"published":"2024-11-25T15:26:43Z","modified":"2024-11-25T15:26:44Z","fixes":[{"ecosystem":"GitHub Actions","package":"dawidd6/action-download-artifact","fixed_in":["6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"GitHub Actions","package":"dawidd6/action-download-artifact","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6"}]}]},{"source":"osv","ecosystem":"GitHub Actions","package":"dawidd6/action-download-artifact","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6"}]}]}],"references":[{"url":"https://github.com/dawidd6/action-download-artifact/security/advisories/GHSA-5xr6-xhww-33m4","tags":["web"]},{"url":"https://github.com/dawidd6/action-download-artifact/commit/bf251b5aa9c2f7eeb574a96ee720e24f801b7c11","tags":["web"]},{"url":"https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5xr6-xhww-33m4"},{"url":"https://github.com/dawidd6/action-download-artifact","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-5xr6-xhww-33m4","title":"Artifact poisoning vulnerability in action-download-artifact v5 and earlier","description":"### Summary\n\nIn versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.\n\nUsers should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set `allow_forks: false` to disable searching forks for artifacts.\n\n### Details\n\nGitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the \"latest\" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream. \n\nBecause any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):\n\n1. Repository `alice/foo` runs `build.yml`, producing `build.exe`\n2. Repository `alice/foo` runs `publish.yml`, which uses `action-download-artifact@v5` to retrieve the latest `build.exe` from `build.yml`\n\nTo compromise `publish.yml` in this scenario, Mallory forks `alice/foo` to `mallory/foo`, and then modifies `build.yml` to produce a compromised `build.exe`. Mallory can then repeatedly trigger their copy of `build.yml` to ensure that their compromised `build.exe` is always the latest artifact, meaning that Alice's `publish.yml` will retrieve it.\n\nAdditional details on this vulnerability can be found in this blog post from 2022:\n\n* https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust\n\n### Impact\n\nThis vulnerability impacts all repositories on GitHub that use `action-download-artifacts@v5` or older and do **not** disable `allow_forks: true`, which is the default.\n\nIf a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as `push` or `pull_request_target`).\n","status":"published","published":"2024-11-25T15:26:43Z","modified":"2024-11-25T15:26:44Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T14:38:22.774145Z"}],"osv":[{"id":"GHSA-5xr6-xhww-33m4","title":"Artifact poisoning vulnerability in action-download-artifact v5 and earlier","description":"### Summary\n\nIn versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.\n\nUsers should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set `allow_forks: false` to disable searching forks for artifacts.\n\n### Details\n\nGitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the \"latest\" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream. \n\nBecause any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):\n\n1. Repository `alice/foo` runs `build.yml`, producing `build.exe`\n2. Repository `alice/foo` runs `publish.yml`, which uses `action-download-artifact@v5` to retrieve the latest `build.exe` from `build.yml`\n\nTo compromise `publish.yml` in this scenario, Mallory forks `alice/foo` to `mallory/foo`, and then modifies `build.yml` to produce a compromised `build.exe`. Mallory can then repeatedly trigger their copy of `build.yml` to ensure that their compromised `build.exe` is always the latest artifact, meaning that Alice's `publish.yml` will retrieve it.\n\nAdditional details on this vulnerability can be found in this blog post from 2022:\n\n* https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust\n\n### Impact\n\nThis vulnerability impacts all repositories on GitHub that use `action-download-artifacts@v5` or older and do **not** disable `allow_forks: true`, which is the default.\n\nIf a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as `push` or `pull_request_target`).\n","status":"published","published":"2024-11-25T15:26:43Z","modified":"2024-11-25T15:26:43Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}