CVE-2022-35954

    Dashboard / Vulnerabilities / CVE-2022-35954

    CVE-2022-35954

    Published: 13 Aug 2022Last Modified: 12 Aug 2026

    Summary: Delimiter injection vulnerability in @actions/core exportVariable

    Details: The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35954.json, https://github.com/actions/toolkit/security/advisories/GHSA-7r3h-m5j6-3q42, https://nvd.nist.gov/vuln/detail/CVE-2022-35954, https://github.com/actions/toolkit/commit/4beda9cbc00ba6eefe387a937c21087ccb8ee9df

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4beda9cbc00ba6eefe387a937c21087ccb8ee9df

    Affected versions

    @actions/[email protected]

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35954 | CVE-DB