PT-2025-33340 · Github+2 · Github Actions+3

P-

·

Published

2025-08-14

·

Updated

2025-09-12

·

CVE-2025-55192

CVSS v4.0

8.6

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions: HomeAssistant-Tapo-Control versions prior to commit 2a3b80f
Description: HomeAssistant-Tapo-Control, a component offering control for Tapo cameras within Home Assistant, contained a code injection vulnerability in the GitHub Actions workflow located at .github/workflows/issues.yml. The vulnerability stemmed from the direct insertion of user-controlled content from the issue body (github.event.issue.body) into a Bash conditional without adequate sanitization. This allowed a malicious GitHub user to craft an issue body capable of executing arbitrary commands on the GitHub Actions runner with elevated privileges upon issue creation. The impact is limited to the repository’s CI/CD environment, potentially exposing repository contents or GitHub Actions secrets.
Recommendations: Disable the affected workflow (issues.yml). Replace the unsafe Bash comparison with a safe quoted grep or a pure GitHub Actions expression check. Ensure minimal permissions in workflows (permissions: block) to reduce potential impact.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-55192
GHSA-XCCG-43HX-C846

Affected Products

Github Actions
Home Assistant
Homeassistant-Tapo-Control
Tapo