PT-2025-30953 · Tj Actions · Branch-Names

Published 2025-07-25 · Updated 2025-08-31 · CVE-2025-54416

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions tj-actions/branch-names versions 8.2.1 and below

Description A critical command injection vulnerability exists in the tj-actions/branch-names GitHub Action workflow. This flaw is due to inconsistent input sanitization and unescaped output, allowing malicious actors to execute arbitrary commands through specially crafted branch or tag names. The vulnerability stems from the unsafe use of the eval printf "%s" pattern within the action's codebase, which reintroduces command injection risks after initial sanitization. This can lead to the theft of sensitive secrets, unauthorized write access, and compromise of repository integrity. Over 5,000 public repositories are potentially affected.

Recommendations Update to version 9.0.0 to address this vulnerability.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-54416

GHSA-GQ52-6PHF-X2R6

Affected Products

Branch-Names

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54416.json · Exploit
• 🔥 https://github.com/tj-actions/branch-names/security/advisories/GHSA-gq52-6phf-x2r6 · Exploit
• https://osv.dev/vulnerability/CVE-2025-54416 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq52-6phf-x2r6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54416 · Security Note
• https://github.com/tj-actions/changed-files/security/advisories/GHSA-mcph-m25j-8j63 · Note
• https://github.com/tj-actions/branch-names · Note
• https://github.com/tj-actions/branch-names/security/advisories/GHSA-8v8w-v8xg-79rf · Note
• https://github.com/tj-actions/branch-names/commit/e497ceb8ccd43fd9573cf2e375216625bc411d1f · Note
• https://github.com/tj-actions/branch-names/releases/tag/v9.0.0 · Note
• https://securitylab.github.com/resources/github-actions-untrusted-input · Note
• https://github.blog/security/application-security/how-to-secure-your-github-actions-workflows-with-codeql · Note
• https://twitter.com/Komodosec/status/1962278019487465561 · Twitter Post
• https://twitter.com/dobaitsu1987/status/1949663946778034567 · Twitter Post
• https://twitter.com/vulert_official/status/1949763936884027706 · Twitter Post