tj-actions/changed-files command injection in output filenames
Priority HIGH 76CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03351 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed changed-files (tj-actions): 41.0.0tj-actions/changed-files (GitHub Actions): 41
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tj-actions | changed-files | before 41.0.0 | 41.0.0 | Patch available | CNA |
| — | tj-actions/changed-files (GitHub Actions) | before 41 | 41 | Patch available | GHSA-mcph-m25j-8j63 |
- changed-files Vendortj-actions Affected before 41.0.0 Fixed in 41.0.0 Patch available CNA
- tj-actions/changed-files (GitHub Actions) Vendor— Affected before 41 Fixed in 41 Patch available GHSA-mcph-m25j-8j63
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:* | before 41.0.0 | Vulnerable | tj-actions |
- cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:* Versions before 41.0.0 Vulnerable ·tj-actions
Remediation
- Fix · CNA changed-files (tj-actions) Fixed in 41.0.0
- Fix · GHSA-mcph-m25j-8j63 tj-actions/changed-files (GitHub Actions) Fixed in 41 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-51664
- 2026-10-03 Alias added: GHSA-mcph-m25j-8j63
References
Patch 3
More tj-actions Changed-files vulnerabilities
- TI-2025-21427 tj-actions changed-files before 46 allows remote attackers to discover secrets by reading… KEVCVSS 3.1HIGH 8.6
Sources
- CVE-2023-51664 · CVE Program
- CVE-2023-51664 · NVD
- FIRST EPSS
- GHSA-mcph-m25j-8j63 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences