PT-2025-35094 · Lychee · Lychee

Published 2025-08-28 · Updated 2025-08-28 · CVE-2024-48908

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: lychee link checking action versions prior to 2.0.2

Description: The GitHub Action variable inputs.lycheeVersion can be used to execute arbitrary code in the context of the action. This can potentially compromise the security of the target repository. The issue resides in lychee-setup of the composite action at action.yml.

Recommendations: Update to version 2.0.2 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-48908

GHSA-65RG-554R-9J5X

Affected Products

Lychee

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48908.json · Exploit
• https://osv.dev/vulnerability/GHSA-65rg-554r-9j5x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48908 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48908 · Vendor Advisory
• https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x · Note
• https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede · Note
• https://github.com/lycheeverse/lychee-action · Note
• https://twitter.com/CVEnew/status/1961085435289256077 · Twitter Post