# CVE-2023-52137: verify-changed-files RCE β€” Fixed in 17 πŸ“¦ πŸ“¦ GitHub Actions Not in CISA KEV HIGH severity # CVE-2023-52137 β€” verify-changed-files HIGH [Fix: tj-actions/verify-changed-files@498d3f3](https://github.com/tj-actions/verify-changed-files/commit/498d3f316f501aa72485060e8c96fde7b2014f12) CVE-2023-52137 is a high-severity (CVSS 7.7) Improper Input Validation vulnerability in tj-actions/verify-changed-files. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for tj-actions/verify-changed-files β€” see the affected versions and patch details below. GitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames Also known as[GHSA-ghm2-rq8q-wrhc](/vulnerability/GHSA-ghm2-rq8q-wrhc) Published Dec 29, 2023 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits 1 known Exploitation data as of Oct 31, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 2.6%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs85th percentile β€” riskier than 85% of all scored CVEsHighest risk 0.02%1.09%2.15%3.22%0.6%2.6%May 26Sep 26Oct 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected πŸ“¦`tj-actions/verify-changed-files` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects GitHub Actions packages β€” download data is not available via public APIs for these ecosystems. ## Description #### Summary The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. #### Details The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` and \` (backtick) which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands an attacker may be able to steal **secrets** such as `GITHUB_TOKEN` if triggered on other events than `pull_request`. For example on `push`. #### Proof of Concept 1. Submit a pull request to the repository with a new file injecting a command. For example `$(whoami).txt` would be a valid filename. 2. Upon approval of the workflow (triggered by the pull request), the action will get executed and the malicious pull request filename will flow into the `List all changed files tracked and untracked files` step. ``` - name: List all changed files tracked and untracked files run: | echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}" ``` Example output: ``` ##[group]Run echo "Changed files: $(whoami).txt" echo "Changed files: $(whoami).txt" shell: /usr/bin/bash -e {0} ##[endgroup] Changed files: runner.txt ``` #### Impact This issue may lead to arbitrary command execution in the GitHub Runner. #### Resolution - A new `safe_output` input would be enabled by default and return filename paths escaping special characters like ;, \` (backtick), $, (), etc for bash environments. - A safe recommendation of using environment variables to store unsafe outputs. ``` - name: List all changed files tracked and untracked files env: CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }} run: | echo "Changed files: $CHANGED_FILES" ``` #### Resources - [Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/) - [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix πŸ“¦GitHub Actions `tj-actions/verify-changed-files` all versions 17 ## Affected Products 1 product Β· 1 configurations Application `verify-changed-files`tj-actions < 17.0.0 range Exploits & PoCs 1 Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization. [ The \[\`tj-actions/verify-changed-files\`\](https://github.com/tj-actions/ve… github.comNVDJan 2024 ](https://github.com/tj-actions/verify-changed-files/security/advisories/GHSA-ghm2-rq8q-wrhc) ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for tj-actions/verify-changed-files, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update tj-actions/verify-changed-files to 17 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2023-52137 is resolved across your whole dependency graph. 3. ### Workarounds Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does. ## Frequently Asked Questions \### Summary The \[\`tj-actions/verify-changed-files\`\](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. ### Details The \[\`verify-changed-files\`\](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as \`;\` and \\\` (backtick) which can be used by an attacker to take over the \[GitHub Runner\](https://docs.github.com/en/ O3 Security Β· Impact-Aware SCA ### Is CVE-2023-52137 in your dependencies? Find it across GitHub Actions, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)