CVE-2025-54430
BaseFortify
Publication date: 2025-07-30
Last updated on: 2025-07-31
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dedupeio | dedupe | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the dedupe python library's GitHub workflow file .github/workflows/benchmark-bot.yml before commit 3f61e79. The workflow can be triggered by an issue_comment containing '@benchmark'. It improperly checks out a branch based on the issue number, which can be manipulated by malicious actors to execute untrusted code. This untrusted code execution can lead to the exfiltration of the GITHUB_TOKEN, which has write permissions on many scopes including repository contents, potentially allowing an attacker to take over the repository.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to execute arbitrary code within the GitHub workflow environment and steal the GITHUB_TOKEN. Since this token has write permissions on the repository, the attacker could modify repository contents, inject malicious code, or take over the repository entirely, leading to significant security risks including code integrity compromise and unauthorized access.
What immediate steps should I take to mitigate this vulnerability?
Update the dedupe repository to include the fix from commit 3f61e79 which corrects the .github/workflows/benchmark-bot.yml workflow to prevent execution of untrusted code. Specifically, ensure that the workflow no longer checks out the branch corresponding to the issue number, which can be manipulated by attackers. This will prevent potential exfiltration of the GITHUB_TOKEN and repository takeover.