How severe is GHSA-5xr6-xhww-33m4?

No CVSS score has been assigned to GHSA-5xr6-xhww-33m4 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5xr6-xhww-33m4?

GHSA-5xr6-xhww-33m4 affects the following packages: dawidd6/action-download-artifact (GitHub Actions). Ecosystems affected: GitHub Actions.

How do I fix GHSA-5xr6-xhww-33m4?

Update dawidd6/action-download-artifact to 6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5xr6-xhww-33m4 is resolved across your whole dependency graph.

How do I detect GHSA-5xr6-xhww-33m4 in my GitHub Actions dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dawidd6/action-download-artifact, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-5xr6-xhww-33m4 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-5xr6-xhww-33m4 actively exploited in the wild?

No public exploit code has been indexed for GHSA-5xr6-xhww-33m4 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-5xr6-xhww-33m4 published, and has it been updated?

GHSA-5xr6-xhww-33m4 was published on November 25, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 GitHub Actions

Not in CISA KEV

Artifact poisoning vulnerability in action-download-artifact v5 and earlierGHSA-5xr6-xhww-33m4

Fix: dawidd6/action-download-artifact@bf251b5

GHSA-5xr6-xhww-33m4 is a security vulnerability in dawidd6/action-download-artifact. A fix is available for dawidd6/action-download-artifact — see the affected versions and patch details below.

Published

Nov 25, 2024

Updated

Nov 25, 2024

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 25, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

📦dawidd6/action-download-artifact

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects GitHub Actions packages — download data is not available via public APIs for these ecosystems.

Description

Summary

In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.

Users should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set allow_forks: false to disable searching forks for artifacts.

Details

GitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the "latest" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream.

Because any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):

Repository alice/foo runs build.yml, producing build.exe
Repository alice/foo runs publish.yml, which uses action-download-artifact@v5 to retrieve the latest build.exe from build.yml

To compromise publish.yml in this scenario, Mallory forks alice/foo to mallory/foo, and then modifies build.yml to produce a compromised build.exe. Mallory can then repeatedly trigger their copy of build.yml to ensure that their compromised build.exe is always the latest artifact, meaning that Alice's publish.yml will retrieve it.

Additional details on this vulnerability can be found in this blog post from 2022:

https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust

Impact

This vulnerability impacts all repositories on GitHub that use action-download-artifacts@v5 or older and do not disable allow_forks: true, which is the default.

If a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as push or pull_request_target).

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦GitHub Actions	`dawidd6/action-download-artifact`	all versions	6

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dawidd6/action-download-artifact, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update dawidd6/action-download-artifact to 6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5xr6-xhww-33m4 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary In versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges. Users should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set `allow_forks: false` to disable searching forks for

O3 Security · Impact-Aware SCA

Is GHSA-5xr6-xhww-33m4 in your dependencies?

Find it across GitHub Actions, including transitive dependencies.

Scan my dependencies How O3 SCA works