Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions

CVE-2023-22381

Summary

A code injection vulnerability allows an attacker with permission to control the environment variable values in GitHub Actions to potentially set arbitrary environment variables. This can lead to unauthorized actions or data leaks depending on the environment set up during CI/CD processes. All versions of GitHub Enterprise Server prior to 3.8.0 are affected, with fixes implemented in versions 3.4.15, 3.5.12, 3.6.8, and 3.7.5. This vulnerability was reported through the GitHub Bug Bounty program, emphasizing the importance of maintaining updated software to prevent exploitation.

References