Command Injection Vulnerability Discovered in tj-actions/changed-files

What changed

The tj-actions/changed-files action has been found to have a significant command injection vulnerability that affects how it handles output filenames. This flaw could enable attackers to execute arbitrary code within the context of the GitHub Actions environment.

Specifically, the issue arises from the action's handling of filenames that may contain special characters, which are not properly sanitized, leading to potential exploitation.

Who is affected

This vulnerability primarily impacts users of the tj-actions/changed-files GitHub Action, particularly those who rely on it for tracking changes in commits and pull requests.

The following groups and products are notably affected:

• Developers utilizing the tj-actions/changed-files action in their CI/CD workflows.
• Organizations that integrate this action into their GitHub repositories.
• Any projects that depend on the output of this action for file change tracking.

What to do

Users of the tj-actions/changed-files action should review their implementations and assess the potential risks associated with this vulnerability.

It is recommended to monitor for updates from the action's maintainers and apply any patches or mitigations as they become available.

• Consider disabling the action until a fix is released.
• Implement additional security measures to limit the impact of potential command injection.
• Stay informed about security advisories related to GitHub Actions.