CVE-2023-27581 — github-slug-action is a GitHub Action to expose slug value of GitHub environment

github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be t

01What is this vulnerability?

github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request…

02Affected products

Vendor	Product	Versions
rlespinasse	github	slug-action — >= 4.0.0, < 4.4.1

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-03-13T20:19:23.350Z
• Last modified: 2025-02-25T14:58:17.504Z

09References

• github.com — https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-…
• github.com — https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e2…
• github.com — https://github.com/rlespinasse/github-slug-action/releases/tag/v4.4.1
• securitylab.github.com — https://securitylab.github.com/research/github-actions-untrusted-input/