Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

GitHub Actions package

check-spelling/check-spelling

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.6GitHub ActionsPublished

    check-spelling workflow vulnerable to token leakage via symlink attack

    CVE-2021-32724 · GHSA-g86g-chm8-7r2p

    Affected
    • GitHub Actions check-spelling/check-spelling < 0.0.19
    Fixed in
    0.0.19· Vendor fix available
    Issue
    Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget (or schedule), an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. Workarounds You can either: Disable the workflow until you've fixed all branches. or Set repository to Allow specific actions. You can check: - [x] Allow actions created by GitHub - [x] Allow Marketplace actions by verified creators check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. or Set repository Workflow permissions to Read repository contents permission. Solution Workflows using check-spelling/check-spelling@main were fixed automatically with the release of v0.0.19. Workflows using a pinned…

    Recommended action: Upgrade to 0.0.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →