Command Injection Vulnerability in tj-actions/changed-files

What changed

A vulnerability has been discovered in the tj-actions/changed-files GitHub Action, which allows for command injection through output filenames. This flaw can enable an attacker to execute arbitrary code and may lead to the exposure of sensitive information.

The issue arises from the action's handling of filenames, which are not adequately sanitized beyond JSON escaping. This oversight can be exploited to include special characters that could trigger command execution.

Who is affected

Users of the tj-actions/changed-files GitHub Action are at risk due to this vulnerability. The following groups are particularly affected:

Developers utilizing GitHub Actions for CI/CD pipelines may inadvertently expose their workflows to this risk.

• Organizations using tj-actions/changed-files for tracking file changes in commits or pull requests.
• Developers who rely on automated workflows that incorporate this action.
• Security teams monitoring GitHub Actions for vulnerabilities in their CI/CD processes.

What to do

It is crucial for users of tj-actions/changed-files to review their workflows and assess the potential impact of this vulnerability. Immediate action is recommended to mitigate risks.

Consider disabling the action or implementing additional input validation to prevent command injection. Regularly monitor for updates or patches from the maintainers of tj-actions.

• Review and update workflows that utilize tj-actions/changed-files.
• Implement strict input validation to sanitize filenames.
• Stay informed about updates from tj-actions regarding this vulnerability.