PT-2025-17465 · Adept · Adept

Jackhac + 1 · Publicado 2025-04-21 · Atualizado 2025-04-26 · CVE-2025-32958

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adept versions prior to commit a1a41b7

Description The issue concerns the exposure of the GITHUB TOKEN in the Adept language workflow. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact, which is a zip of the current directory and includes the automatically generated .git/config file containing the run's GITHUB TOKEN. This allows an attacker to extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in the AdeptLanguage/Adept repository.

Recommendations For versions prior to commit a1a41b7, update to a version that includes the patch from commit a1a41b7 to resolve the issue. As a temporary workaround, consider restricting access to the actions/upload-artifact@v4 action in the remoteBuild.yml workflow file until the patch is applied.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-32958

GHSA-8C7V-VCCV-CX4Q

Produtos afetados

Adept

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32958.json · Exploit
• https://github.com/AdeptLanguage/Adept/security/advisories/GHSA-8c7v-vccv-cx4q · Nota
• https://github.com/AdeptLanguage/Adept/commit/a1a41b72cdf1bebfc0cf6d7b3a8350e6406b2220 · Nota
• https://t.me/cvetracker/22074 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1914584179292962895 · Publicação no Twitter
• https://twitter.com/cracbot/status/1916084914660823508 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1914436780805193812 · Publicação no Twitter
• https://t.me/cvenotify/119265 · Publicação no Telegram
• https://t.me/latest_high_impact_cve/2181 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-32958 · Aviso do Fabricante
• https://t.me/cvedetector/23464 · Publicação no Telegram
• https://t.me/purp_sec/544 · Publicação no Telegram
• https://twitter.com/cracbot/status/1915722515131093452 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-32958 · Nota de Segurança
• https://twitter.com/CVEnew/status/1914427572345069837 · Publicação no Twitter