CVE-2024-48908CWE-94code-injection

CVE-2024-48908

published August 28, 2025

CVSS
6.9
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00385 · 31.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-08-28T19:15Z
References (2)
https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede · [email protected]https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x · [email protected]
EPSS history
Timeline
  • 28 AUG 14:56Z
    lychee-action vulnerable to arbitrary code injection in composite action
    cvelistv5