« Volver al listado

CVE-2025-54416

Estado: AplazadaCrítica (9.1)—

tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:L requiere acceso remoto autenticado a GitHub. Outputs sin escape de ramas maliciosas permiten ejecución de comandos en workflows downstream (T1059). Manipulación de datos de rama (T1565) secundaria.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tj-actions — Branch-namesAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-54416",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54416",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-28T15:28:06.240335Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "tj-actions",
          "product": "branch-names",
          "versions": [
            {
              "status": "affected",
              "version": "< 9.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-26T04:16:10.107",
  "references": [
    {
      "url": "https://github.com/tj-actions/branch-names/commit/e497ceb8ccd43fd9573cf2e375216625bc411d1f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/tj-actions/branch-names/releases/tag/v9.0.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/tj-actions/branch-names/security/advisories/GHSA-gq52-6phf-x2r6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/tj-actions/branch-names/security/advisories/GHSA-gq52-6phf-x2r6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0"
    },
    {
      "lang": "es",
      "value": "tj-actions/branch-names es un repositorio de acciones de GitHub que contiene flujos de trabajo para recuperar nombres de ramas o etiquetas, compatible con todos los eventos. En las versiones 8.2.1 y anteriores, se identificó una vulnerabilidad crítica en el flujo de trabajo de acciones de GitHub de tj-actions/branch-names, que permite la ejecución de comandos arbitrarios en flujos de trabajo posteriores. Este problema surge debido a una depuración de entrada inconsistente y una salida sin escape, lo que permite a actores maliciosos explotar nombres de ramas o etiquetas especialmente manipulados. Si bien se han implementado mecanismos internos de depuración, las salidas de las acciones siguen siendo vulnerables, lo que expone a los flujos de trabajo que consumen recursos a importantes riesgos de seguridad. Esto se solucionó en la versión 9.0.0."
    }
  ],
  "lastModified": "2026-06-17T09:40:03.833",
  "sourceIdentifier": "security-advisories@github.com"
}