Research · Jul 25, 2025
Critical Command Injection Vulnerability in tj-actions/branch-names
A severe command injection vulnerability has been discovered in tj-actions/branch-names, allowing potential exploitation through specially crafted branch names or tags.
What changed
A critical command injection vulnerability has been identified in the tj-actions/branch-names GitHub Action workflow. This flaw allows malicious actors to execute arbitrary commands in downstream workflows due to inconsistent input sanitization and unescaped output.
- The vulnerability arises from unsafe handling of branch names and tags.
- Initial sanitization mechanisms are in place, but they do not fully mitigate the risks.
- Consuming workflows remain exposed to significant security threats.
Who is affected
Various users and organizations utilizing tj-actions/branch-names are at risk due to this vulnerability. The following groups should be particularly vigilant:
- Developers using GitHub Actions for CI/CD pipelines.
- Organizations relying on automated workflows for deployment.
- Any project that incorporates tj-actions/branch-names in their GitHub Actions.
- Users who have not updated their workflows to address this vulnerability.
What to do
It is crucial for affected users to take immediate action to secure their workflows. Recommendations include:
- Review and update the tj-actions/branch-names action to the latest version.
- Implement additional input validation and sanitization in workflows.
- Monitor for any unusual activity in workflows that utilize this action.
- Stay informed about updates and patches related to this vulnerability.