PT-2025-31382 · Dedupe · Dedupe

Albertopellitteri + 1 · Published 2025-07-30 · Updated 2025-07-30 · CVE-2025-54430

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions dedupe versions prior to commit 3f61e79

Description dedupe is a Python library used for fuzzy matching, deduplication, and entity resolution on structured data. A critical severity issue exists in the .github/workflows/benchmark-bot.yml workflow, triggered by an issue comment with the @benchmark body. This workflow checks out the branch of a pull request (PR) manipulated by potentially malicious actors, leading to the execution of untrusted code. This could result in the exfiltration of the GITHUB TOKEN, which has write permissions, potentially leading to repository takeover.

Recommendations Update to commit 3f61e79 or later to resolve this issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-54430

GHSA-WRG3-XQW8-M85P

Affected Products

Dedupe

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54430.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54430 · Security Note
• https://github.com/dedupeio/dedupe/commit/3f61e79102910bd355e920a2df7e44c14c9cb247 · Note
• https://github.com/dedupeio/dedupe/security/advisories/GHSA-wrg3-xqw8-m85p · Note
• https://twitter.com/VulmonFeeds/status/1950566523514315009 · Twitter Post
• https://twitter.com/CveFindCom/status/1950559663050707142 · Twitter Post
• https://twitter.com/CVEnew/status/1950562085638967348 · Twitter Post
• https://t.me/CVEtracker/28743 · Telegram Post