Critical severity · published Dec 27, 2023
CVE-2023-51664
tj-actions/changed-files command injection in output filenames
9.8
CVSS
3.4%
EPSS
No
On KEV
Description
tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
changed-files · tj-actions
< 41.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-51664
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-51664
Patch
https://github.com/tj-actions/changed-files/commit/0102c07446a3cad972f4afcbd0ee4dbc4b6d2d1b
Patch
https://github.com/tj-actions/changed-files/commit/716b1e13042866565e00e85fd4ec490e186c4a2f
Patch
https://github.com/tj-actions/changed-files/commit/ff2f6e6b91913a7be42be1b5917330fe442f2ede
Exploit
https://github.com/tj-actions/changed-files/security/advisories/GHSA-mcph-m25j-8j63
More from changed-files
8.6
CVE-2025-30066
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability