« Volver al listado

CVE-2025-53546

Estado: AplazadaCrítica (9.1)—

Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-829 + pull_request_target en workflows: inyección en cadena de suministro (CI/CD). Exfiltra GITHUB_TOKEN con permisos de contenido, permitiendo suplantación de cuenta y control del repositorio.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Application Developer GuidanceUser Account ManagementUpdate SoftwareVulnerability ScanningThreat Intelligence ProgramPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Folo — FoloAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53546",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53546",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-09T16:00:26.658492Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "RSSNext",
          "product": "Folo",
          "versions": [
            {
              "status": "affected",
              "version": "< 585c6a591440cd39f92374230ac5d65d7dd23d6a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-09T15:15:24.787",
  "references": [
    {
      "url": "https://github.com/RSSNext/Folo/commit/585c6a591440cd39f92374230ac5d65d7dd23d6a",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a."
    },
    {
      "lang": "es",
      "value": "Folo organiza el contenido de los feeds en una sola línea de tiempo. El uso de pull_request_target en .github/workflows/auto-fix-lint-format-commit.yml puede ser explotado por atacantes, ya que se puede ejecutar código no confiable con acceso completo a los secretos (del repositorio base). Al explotar esta vulnerabilidad, es posible exfiltrar GITHUB_TOKEN, que tiene altos privilegios. GITHUB_TOKEN puede usarse para controlar completamente el repositorio, ya que el token tiene privilegios de escritura de contenido. Esta vulnerabilidad está corregida en el commit 585c6a591440cd39f92374230ac5d65d7dd23d6a."
    }
  ],
  "lastModified": "2026-06-17T09:38:25.440",
  "sourceIdentifier": "security-advisories@github.com"
}