CVE-2025-54416 (CNNVD-202507-3370)
中文标题:
branch-names 命令注入漏洞
英文标题:
tj-actions/branch-names Contains Command Injection Vulnerability
漏洞描述
中文描述:
branch-names是tj-actions开源的一个用于检索分支或标签名称的工具。 branch-names 8.2.1及之前版本存在命令注入漏洞，该漏洞源于输入清理和输出转义不足，可能导致任意命令执行。
英文描述:
tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| tj-actions | branch-names | < 9.0.0 | - | - |
cpe:2.3:a:tj-actions:branch-names:<_9.0.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
CVSS评分详情
3.1 (cna)
CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-54416 |
2025-11-11 15:23:28 | 2025-11-11 07:40:42 |
| NVD | nvd_CVE-2025-54416 |
2025-11-11 15:00:57 | 2025-11-11 07:48:29 |
| CNNVD | cnnvd_CNNVD-202507-3370 |
2025-11-11 15:12:51 | 2025-11-11 08:00:02 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 命令注入
- cnnvd_id: 未提取 -> CNNVD-202507-3370
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']