ZeroDay Findings
Sign inSign up

Findings

CVE-2023-27581

github-slug-action vulnerable to arbitrary code execution

Published Mar 13, 2023 · updated Sep 10, 2026

### Impact This action uses the parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). This can be used to execute code on the GitHub runners (potentially use it for crypto-mining, and waste your resources) and to exfiltrate any secrets you use in the CI pipeline. ### Patches > Pass the variable as an environment variable and then use the environment variable instead of substituting it directly. Patched action is available on tag **v4**, tag **v4.4.1**, and any tag beyond. ### Workarounds No workaround is available if impacted, please upgrade the version > ℹ️ **v3** and **v4** are compatibles. ### References [Here](https://securitylab.github.com/research/github-actions-untrusted-input/) is a set of blog posts by Github's security team explaining this issue. ### Thanks Thanks to the team of researchers from Purdue University, who are working on finding vulnerabilities in CI/CD configurations of open-source software. Their tool detected this security vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 13, 2023 · GitHub Advisory Database

    Detected

    ### Impact This action uses the parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). This c

  2. Sep 10, 2026 · GitHub Advisory Database

    Fix available

    rlespinasse/github-slug-action fixed in 4.4.1

  3. Sep 10, 2026 · GitHub Advisory Database

    Fix available

    rlespinasse/github-slug-action fixed in 4.4.1

  4. Sep 10, 2026 · GitHub Advisory Database

    Updated

    ### Impact This action uses the parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). This c

Affected

  • GitHub Actions rlespinasse/github-slug-action4.0.0 → 4.4.1

Sources

References