Actions vulnerabilities

Products

• Toolkit 4
• Http-client 2

Newest

• sensiolabs symfony, actions http-client, symfony http-foundation +2 more Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient CVE-2026-48736 Fix available 6.9 MediumJune 15, 2026
• actions toolkit actions toolkit glob internal-pattern.ts globEscape redos CVE-2025-5890 5.3 MediumJune 9, 2025
• actions toolkit, github actions\/artifact, actions toolkit +2 more Arbitrary File Write via artifact extraction in actions/artifact CVE-2024-42471 Public exploitFix available 7.3 HighSeptember 2, 2024
• actions runner GitHub Actions Runner vulnerable to Docker Command Escaping CVE-2022-39321 Fix available 8.8 HighOctober 25, 2022
• actions toolkit Delimiter injection vulnerability in @actions/core exportVariable CVE-2022-35954 Fix available 5.0 MediumAugust 13, 2022
• actions toolkit Environment Variable Injection in GitHub Actions CVE-2020-15228 Public exploitFix available 3.5 LowOctober 1, 2020
• actions http-client HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client CVE-2020-11021 Fix available 6.3 MediumApril 29, 2020