PT-2025-39926 · Unknown+5 · Serverless-Dns+6

Yaniv-Git · Published 2025-09-30 · Updated 2025-12-08 · CVE-2025-61584

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions serverless-dns versions through 0.1.30

Description serverless-dns is a RethinkDNS resolver that deploys to various platforms including Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. A flaw exists where the pr.yml GitHub Action interpolates untrusted input, specifically the github.event.pull request.head.repo.clone url and github.head ref variables, into a command executed by the runner. Because the action uses the pull request target trigger, it has permissive permissions by default. An attacker can exploit this to push arbitrary data to the repository, leading to the execution of the attacker's code when running serverless-dns.

Recommendations Update to version 0.1.31 or later.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-61584

GHSA-9G7X-737F-5XPC

Affected Products

Cloudflare Workers

Deno Deploy

Fastly

Fly.Io

Github

Rethinkdns

Serverless-Dns

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61584.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-61584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61584 · Security Note
• https://github.com/serverless-dns/serverless-dns/commit/c5537dd7f203c59f2b86d1e295c2371f3533946a · Note
• https://github.com/serverless-dns/serverless-dns/security/advisories/GHSA-9g7x-737f-5xpc · Note
• https://t.me/CVEtracker/33688 · Telegram Post
• https://twitter.com/Awkiffffff/status/1998057881825153420 · Twitter Post
• https://twitter.com/0dayPublishing/status/1972823389938028689 · Twitter Post