GHSA-mj96-mh85-r574 — buildalon/setup-steamcmd
Fix: buildalon/setup-steamcmd@c330196GHSA-mj96-mh85-r574 is a security vulnerability in buildalon/setup-steamcmd. A fix is available for buildalon/setup-steamcmd — see the affected versions and patch details below.
buildalon/setup-steamcmd leaked authentication token in job output logs
Real-World Exposure
buildalon/setup-steamcmdReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects GitHub Actions packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Log output includes authentication token that provides full account access
Details
The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves authentication tokes for the associated steam accounts publicly available. Additionally, userdata/$user_id$/config/localconfig.vdf contains potentially sensitive information which should not be included in public logs.
PoC
Use the following workflow step
steps:
- name: Setup SteamCMD
uses: buildalon/[email protected]
- name: Sign into steam
shell: bash
run: |
steamcmd +login ${{ secrets.WORKSHOP_USERNAME }} ${{ secrets.WORKSHOP_PASSWORD }} +quit
Impact
Anyone who has used this workflow action with a steam account is affected and has had valid authentication tokens leaked in the job logs. This is particularly bad for public repositories, as anyone with a GitHub account can access the logs and view the token.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦GitHub Actions | buildalon/setup-steamcmd | all versions | 1.1.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for buildalon/setup-steamcmd, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update buildalon/setup-steamcmd to 1.1.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mj96-mh85-r574 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-mj96-mh85-r574 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-mj96-mh85-r574. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-mj96-mh85-r574 in your dependencies?
O3 Security finds GHSA-mj96-mh85-r574 across GitHub Actions dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.