Read the docs
TI-2024-38500 Aliases GHSA-7f32-hm4h-w77q

github-slug-action use of `set-env` Runner commands which are processed via stdout

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact This GitHub Action use `set-env` runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w ### Patches The following versions use the recommended [Environment File Syntax](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files). - 2.1.1 - 1.1.1 ### Workarounds None, it is strongly suggested that you upgrade as soon as possible. ### For more information If you have any questions or comments about this advisory: * Open an issue in [rlespinasse/github-slug-action](https://github.com/rlespinasse/github-slug-action)

Why it matters now

Fix Fixed rlespinasse/github-slug-action (GitHub Actions): 1.1.1, 2.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—rlespinasse/github-slug-action (GitHub Actions)before 1.1.11.1.1Patch availableGHSA-7f32-hm4h-w77q
—rlespinasse/github-slug-action (GitHub Actions)2.0.0 to before 2.1.12.1.1Patch availableGHSA-7f32-hm4h-w77q
  • rlespinasse/github-slug-action (GitHub Actions) Vendor— Affected before 1.1.1 Fixed in 1.1.1 Patch available GHSA-7f32-hm4h-w77q
  • rlespinasse/github-slug-action (GitHub Actions) Vendor— Affected 2.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-7f32-hm4h-w77q

Remediation

  • Fix · GHSA-7f32-hm4h-w77q rlespinasse/github-slug-action (GitHub Actions) Fixed in 1.1.1 Advisory →
  • Fix · GHSA-7f32-hm4h-w77q rlespinasse/github-slug-action (GitHub Actions) Fixed in 2.1.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7f32-hm4h-w77q

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences