Shell-injection in git-tag-annotation GitHub action
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version 1.0.1. If you don't use the `tag` input you are most likely safe. The `GITHUB_REF` environment variable is protected by the GitHub Actions environment so attacks from there should be impossible. If you must use the `tag` input and cannot upgrade to `> 1.0.0` make sure that the value is not controlled by another Action.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ericcornelissen | git-tag-annotation-action | before 1.0.1 | 1.0.1 | Patch available | CNA |
- git-tag-annotation-action Vendorericcornelissen Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:git-tag-annotation-action_project:git-tag-annotation-action:*:*:*:*:*:*:*:* | before 1.0.1 | Vulnerable | Git-tag-annotation-action Project |
- cpe:2.3:a:git-tag-annotation-action_project:git-tag-annotation-action:*:*:*:*:*:*:*:* Versions before 1.0.1 Vulnerable ·Git-tag-annotation-action Project
Remediation
- Fix · CNA git-tag-annotation-action (ericcornelissen) Fixed in 1.0.1
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15272
References
More ericcornelissen vulnerabilities
- TI-2022-13220 Insufficient escaping of whitespace in shescape CVSS 3.1CRITICAL 9.8
- TI-2022-13219 Insufficient escaping of line feeds for CMD in shescape CVSS 3.1CRITICAL 9.8
- TI-2022-09469 Regular expression denial of service (ReDoS) in shescape CVSS 3.1HIGH 7.5
- TI-2026-24632 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVSS 4.0MEDIUM 6.9
- TI-2022-16487 Shescape Inefficient Regular Expression Complexity vulnerability CVSS 3.1HIGH 7.5
- TI-2022-08540 Exposure of home directory through shescape on Unix with Bash CVSS 3.1MEDIUM 6.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences