« Volver al listado

CVE-2025-32958

Estado: AplazadaCrítica (9.8)—

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in the AdeptLanguage/Adept repository. This issue has been patched in commit a1a41b7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Flujo de trabajo expuesto (GitHub Actions) publica artefacto con token GITHUB_TOKEN en .git/config descargable en ventana temporal; atacante remoto sin privilegios accede a credenciales y manipula repositorio.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementUser Account ManagementPassword PoliciesMulti-factor AuthenticationApplication Developer GuidanceActive Directory Configuration

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Adept — AdeptAIGithub — Actions Upload ArtifactAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32958",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32958",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-22T02:21:03.195446Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "AdeptLanguage",
          "product": "Adept",
          "versions": [
            {
              "status": "affected",
              "version": "< a1a41b7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-21T21:15:20.780",
  "references": [
    {
      "url": "https://github.com/AdeptLanguage/Adept/commit/a1a41b72cdf1bebfc0cf6d7b3a8350e6406b2220",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/AdeptLanguage/Adept/security/advisories/GHSA-8c7v-vccv-cx4q",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in the AdeptLanguage/Adept repository. This issue has been patched in commit a1a41b7."
    },
    {
      "lang": "es",
      "value": "Adept es un lenguaje de programación de propósito general. Antes del commit a1a41b7, el archivo de flujo de trabajo remoteBuild.yml usaba actions/upload-artifact@v4 para cargar el artefacto independiente para Mac. Este artefacto es un archivo zip del directorio actual, que incluye el archivo .git/config generado automáticamente con el GITHUB_TOKEN de la ejecución. Dado que el artefacto se puede descargar antes de finalizar el flujo de trabajo, un atacante puede extraer el token del artefacto durante unos segundos y usarlo con la API de Github para enviar código malicioso o reescribir las confirmaciones de versiones en el repositorio AdeptLanguage/Adept. Este problema se ha corregido en el commit a1a41b7."
    }
  ],
  "lastModified": "2026-06-17T09:12:51.887",
  "sourceIdentifier": "security-advisories@github.com"
}