Arbitrary Command Execution Vulnerability in tj-actions/branch-names GitHub Action
CVE-2025-54416

9.1CRITICAL

Key Information:

Vendor

Tj-actions

Status
Branch-names
Vendor
CVE Published:
26 July 2025

What is CVE-2025-54416?

The tj-actions/branch-names GitHub Action is vulnerable to arbitrary command execution due to inconsistent input sanitization and unescaped output. Specifically, versions 8.2.1 and below allow attackers to exploit specially crafted branch names or tags, leading to potential execution of malicious commands in downstream workflows. Although internal mechanisms for sanitization have been introduced, the vulnerability in action outputs persists, posing significant security risks to consuming workflows. The issue has been addressed in version 9.0.0.

Affected Version(s)

branch-names < 9.0.0

References

https://github.com/tj-actions/branch-names/security/advis...
x_refsource_CONFIRM
https://github.com/tj-actions/branch-names/commit/e497ceb...
x_refsource_MISC
https://github.com/tj-actions/branch-names/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.