{"id":"CVE-2023-27581","aliases":["GHSA-6q4m-7476-932w"],"url":"https://o3.security/vulnerability/CVE-2023-27581","summary":"github-slug-action vulnerable to arbitrary code execution","details":"github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.","published":"2023-03-13T20:19:23.350Z","modified":"2026-08-12T03:51:14.789161107Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"GitHub Actions","name":"rlespinasse/github-slug-action","fixedVersion":"4.4.1"}],"fix":{"url":"https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e22b18b19c624538d94","label":"rlespinasse/github-slug-action@102b1a0"},"references":[{"type":"WEB","url":"https://github.com/rlespinasse/github-slug-action/releases/tag/v4.4.1"},{"type":"WEB","url":"https://securitylab.github.com/research/github-actions-untrusted-input/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27581.json"},{"type":"ADVISORY","url":"https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-7476-932w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27581"},{"type":"FIX","url":"https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e22b18b19c624538d94"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.789161107Z"}}