onyx --cves cve-2025-49013
CVE-2025-49013
- score
- <0.1
- cvss
- 9.9
- epss
- 0.8%
- published
- 2025-06-09
- kev added
- —
- first seen
WilderForge GitHub Actions workflows contain a command injection vulnerability caused by unsafe usage of user-controlled variables like `${{ github.event.review.body }}` in shell script contexts, letting malicious pull request reviewers execute arbitrary shell commands on the CI runner, exploit requires crafted pull request review input.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#preventing-script-injection
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injection
- https://github.com/WilderForge/WilderForge/security/advisories/GHSA-m6r3-c73x-8fw5
- https://securitylab.github.com/research/github-actions-untrusted-input