CVE-2025-54594
BaseFortify
Publication date: 2025-08-06
Last updated on: 2025-08-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| callstackincubator | react-native-bottom-tabs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in react-native-bottom-tabs versions 0.9.2 and below, where a GitHub Actions workflow (release-canary.yml) improperly used the pull_request_target event trigger. This allowed an attacker to execute untrusted code from a forked pull request in a privileged context by creating a pull request with a malicious preinstall script and triggering the workflow with a specific comment. This led to arbitrary code execution and exposure of sensitive secrets like GITHUB_TOKEN and NPM_TOKEN.
How can this vulnerability impact me? :
The vulnerability can lead to arbitrary code execution within the repository's GitHub Actions environment, allowing an attacker to exfiltrate sensitive secrets such as GITHUB_TOKEN and NPM_TOKEN. This could enable the attacker to push malicious code to the repository or publish compromised packages to the NPM registry, potentially affecting the integrity and security of your software supply chain.
What immediate steps should I take to mitigate this vulnerability?
Immediately remove or disable the github/workflows/release-canary.yml workflow from your repository to prevent execution of untrusted code via the pull_request_target event. Avoid merging pull requests from forked repositories until a fixed version of react-native-bottom-tabs is released. Review and rotate any potentially exposed secrets such as GITHUB_TOKEN and NPM_TOKEN to prevent unauthorized access.