CVE-2022-35954

score

<0.1

cvss

5.0

epss

0.7%

published

2022-08-15

kev added

—

first seen

2026-10-21

GitHub Actions Toolkit's core.exportVariable function in @actions/core contains a delimiter vulnerability that allows attackers to break out of the variable and assign values to other arbitrary variables, letting malicious users modify environment variables, exploit requires writing untrusted values to GITHUB_ENV.