CVE-2023-49291

Summary

CVE-2023-49291 is a vulnerability affecting the `tj-actions/branch-names` GitHub action. This action, which retrieves branch or tag names, mishandles the `github.event.pull_request.head.ref` and `github.head_ref` context variables in a `run` step. An attacker can manipulate these variables to execute arbitrary code, leading to potential secret theft or misuse of `GITHUB_TOKEN` permissions. The vulnerability has been remedied in version 7.0.7, and users are advised to upgrade promptly. No known workarounds are available for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.