Vulnerabilities in tj-actions

5 results
Vexday analysis

O tj-actions apresenta um perfil de risco moderado com 5 vulnerabilidades catalogadas, das quais 1 está sob ataque ativo (KEV). Duas dessas falhas atingem severidade crítica, sendo a validação inadequada de entrada (CWE-20) a fraqueza predominante. Não há registros de divulgações nos últimos 90 dias, indicando risco estabilizado, embora a presença de exploração ativa demande atenção.

CVE-2025-30066HIGHtj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were afEPSS 69.8%KEVCVE-2023-51664HIGHtj-actions/changed-files command injection in output filenamesEPSS 3.4%CVE-2023-52137HIGHGitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenamesEPSS 2.6%CVE-2023-49291CRITICALImproper Sanitization of Branch Name Leads to Arbitrary Code InjectionEPSS 1.4%CVE-2025-54416CRITICALtj-actions/branch-names Contains Command Injection VulnerabilityEPSS 0.6%