CVE-2022-39326

    Dashboard / Vulnerabilities / CVE-2022-39326

    CVE-2022-39326

    Published: 25 Oct 2022Last Modified: 28 Oct 2026

    Summary: kartverket/github-workflows's run-terraform allows for RCE via terraform plan

    Details: kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the context of the workflow. Users should upgrade to at least version 2.7.5 to resolve the issue. As a workaround, review any pull requests from external users for malicious payloads before allowing them to trigger a build.

    References: https://github.com/kartverket/github-workflows/releases/tag/v2.7.5, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39326.json, https://github.com/kartverket/github-workflows/security/advisories/GHSA-f9qj-7gh3-mhj4, https://nvd.nist.gov/vuln/detail/CVE-2022-39326, https://github.com/kartverket/github-workflows/pull/19

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5906b1a328b3559c8a4c435aaf2c21d195834484

    Affected versions

    v2.7.4
    v2.7.3
    v2.7.2
    v2.7.1
    v2.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39326 | CVE-DB