TI-2020-11112 Aliases CVE-2020-14189

The execute function in in the Atlassian gajira-comment GitHub Action before version…

MEDIUM 47Published 2020-11-09 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment.

Why it matters now

EPSS 0.02351 83rd percentileScored 2026-11-07

Fix Fixed gajira-comment (Atlassian): 2.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	gajira-comment	before 2.0.2	2.0.2	Patch available	CNA

gajira-comment VendorAtlassian Affected before 2.0.2 Fixed in 2.0.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:jira_comment::::::::	before 2.0.2	Vulnerable	Atlassian

cpe:2.3:a:atlassian:jira_comment:*:*:*:*:*:*:*:* Versions before 2.0.2 Vulnerable ·Atlassian

Remediation

Fix · CNA gajira-comment (Atlassian) Fixed in 2.0.2

Timeline

2026-10-02 Threatist record created from CVE-2020-14189

References

Advisory 1

https://github.com/atlassian/gajira-comment/security/advisories/GHSA-hj6w-pm28-h8hf

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences