NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 GitHub Actions
Not in CISA KEV
CRITICAL severity

CVE-2020-14188 — gajira-create

CRITICAL

CVE-2020-14188 is a critical-severity (CVSS 9.8) remote code execution vulnerability in atlassian/gajira-create. A fix is available for atlassian/gajira-create — see the affected versions and patch details below.

gajira-create GitHub action vulnerable to arbitrary code execution

Also known asGHSA-4xqx-pqpj-9fqw
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs87th percentile — riskier than 87% of all scored CVEsHighest risk
1.64%2.21%2.79%3.37%2.1%2.9%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
📦atlassian/gajira-create

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects GitHub Actions packages — download data is not available via public APIs for these ecosystems.

Description

Impact

An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue.

Patches

This issue is patched in gajira-create version 2.0.1.

Workarounds

There are no known workarounds.

References

GitHub Security Lab advisory GHSL-2020-172

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦GitHub Actionsatlassian/gajira-createall versions2.0.1

Affected Products

1 product · 1 configurations
Application
jira createatlassian
< 2.0.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for atlassian/gajira-create, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update atlassian/gajira-create to 2.0.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-14188 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. ### Patches This issue is patched in gajira-create version 2.0.1. ### Workarounds There are no known workarounds. ### References [GitHub Security Lab advisory GHSL-2020-172](https://securitylab.github.com/advisories/GHSL-2020-172-gajira-create-action)
O3 Security · Impact-Aware SCA

Is CVE-2020-14188 in your dependencies?

Find it across GitHub Actions, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2020-14188: gajira-create RCE — Fixed in 2.0.1