Arbitrary Code Execution Vulnerability in RethinkDNS Resolver by Serverless-DNS
CVE-2025-61584

9.3CRITICAL

Key Information:

Vendor

Serverless-dns

Status
Serverless-dns
Vendor
CVE Published:
30 September 2025

What is CVE-2025-61584?

The RethinkDNS resolver from Serverless-DNS contains a vulnerability due to unsafe interpolation of untrusted input in its GitHub Action. Specifically, when using the pull_request_target trigger, the action inherits permissive permissions, allowing unauthorized attackers to exploit this flaw. This risk enables malicious actors to push arbitrary code to the repository and execute it when the Serverless-DNS action runs. A fix has been implemented in commit c5537dd and is expected to be available in version 0.1.31.

Affected Version(s)

serverless-dns < 0.1.31

References

https://github.com/serverless-dns/serverless-dns/security...
x_refsource_CONFIRM
https://github.com/serverless-dns/serverless-dns/commit/c...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-61584 : Arbitrary Code Execution Vulnerability in RethinkDNS Resolver by Serverless-DNS