Critical · published July 26, 2025
🚨 A sneaky flaw in tj-actions/branch-names lets attackers execute arbitrary commands just by crafting a clever branch name! 🔥 Think of it like a restaurant where customers can write their own orders — if the kitchen isn’t careful, they might end up serving a dish that wasn’t on the menu at all! 🎭 This vulnerability is absolutely devastating; an attacker could hijack workflows, run malicious commands, or manipulate repository operations, leading to a complete compromise of your build process. The consequences could be catastrophic! 🥵
Think of it like a restaurant where customers can write their own orders — if the kitchen isn’t careful, they might end up serving a dish that wasn’t on the menu at all! 🎭 This flaw in versions 8.2.1 and below results from inconsistent input sanitization and unescaped output in the tj-actions/branch-names GitHub Action workflow, allowing specially crafted branch names to trigger harmful commands in downstream workflows.
This vulnerability is absolutely devastating; an attacker could hijack workflows, run malicious commands, or manipulate repository operations, leading to a complete compromise of your build process. The consequences could be catastrophic! 🥵 To safeguard your workflows, upgrade to tj-actions/branch-names version 9.0.0 immediately. Additionally, review and harden any workflows consuming this action to ensure they handle inputs safely. 🛡️ You've got this! By following these steps, you'll have your security locked down in no time! 💪✨