ZeroDay Findings
Sign inSign up

Findings

CVE-2020-14188

gajira-create GitHub action vulnerable to arbitrary code execution

Published Oct 7, 2022 · updated Sep 10, 2026

### Impact An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. ### Patches This issue is patched in gajira-create version 2.0.1. ### Workarounds There are no known workarounds. ### References [GitHub Security Lab advisory GHSL-2020-172](https://securitylab.github.com/advisories/GHSL-2020-172-gajira-create-action)

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 7, 2022 · GitHub Advisory Database

    Detected

    ### Impact An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. ### Patches This issue is patched in gajira-create version 2.0.1. ### Workarounds There are no known workarounds. ### References [GitHub Security Lab advisory GHSL-2020-172](https://securitylab.github.com/advisories/GHSL-2020-172-gajira-create-action)

  2. Sep 10, 2026 · GitHub Advisory Database

    Fix available

    atlassian/gajira-create fixed in 2.0.1

  3. Sep 10, 2026 · GitHub Advisory Database

    Fix available

    atlassian/gajira-create fixed in 2.0.1

  4. Sep 10, 2026 · GitHub Advisory Database

    Updated

    ### Impact An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. ### Patches This issue is patched in gajira-create version 2.0.1. ### Workarounds There are no known workarounds. ### References [GitHub Security Lab advisory GHSL-2020-172](https://securitylab.github.com/advisories/GHSL-2020-172-gajira-create-action)

Affected

  • GitHub Actions atlassian/gajira-create0 → 2.0.1

Sources

References