Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

GitHub Actions package

atlassian/gajira-create

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8GitHub ActionsPublished

    gajira-create GitHub action vulnerable to arbitrary code execution

    CVE-2020-14188 · GHSA-4xqx-pqpj-9fqw

    Affected
    • GitHub Actions atlassian/gajira-create < 2.0.1
    Fixed in
    2.0.1· Vendor fix available
    Issue
    Impact An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. Patches This issue is patched in gajira-create version 2.0.1. Workarounds There are no known workarounds. References GitHub Security Lab advisory GHSL-2020-172

    Recommended action: Upgrade to 2.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →