CVE-2023-49291 — tj-actions/branch-names is a Github action to retrieve branch or tag names with

tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run

01What is this vulnerability?

tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted…

02Affected products

Vendor	Product	Versions
tj-actions	branch	names — < 7.0.7

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-12-04T23:21:33.367Z
• Last modified: 2024-08-02T21:53:44.957Z

09References

• github.com — https://github.com/tj-actions/branch-names/security/advisories/GHSA-8v8w-v8xg-79…
• github.com — https://github.com/tj-actions/branch-names/commit/4923d1ca41f928c24f1c1b3af9daaa…
• github.com — https://github.com/tj-actions/branch-names/commit/6c999acf206f5561e19f46301bb310…
• github.com — https://github.com/tj-actions/branch-names/commit/726fe9ba5e9da4fcc716223b7994ff…
• securitylab.github.com — https://securitylab.github.com/research/github-actions-untrusted-input