Critical · published July 30, 2025
🚨 A single comment can be a game-changer! The dedupe Python library's workflow allows malicious actors to execute untrusted code just by triggering an issue comment. 🔥 Imagine a restaurant where the chef blindly follows any note left on the kitchen counter without checking it. One sneaky customer could order something dangerous, and before you know it, the whole kitchen is in chaos! With this vulnerability, an attacker could potentially gain access to the GITHUB_TOKEN, which has write permissions on your repository. This could lead to a complete takeover of your project, jeopardizing not just your data, but your entire workflow. It's as if they walked right in and started rearranging everything without your permission!
Imagine a restaurant where the chef blindly follows any note left on the kitchen counter without checking it. One sneaky customer could order something dangerous, and before you know it, the whole kitchen is in chaos! The vulnerability in the dedupe library occurs due to the .github/workflows/benchmark-bot.yml workflow's reliance on the ${{ github.event.issue.number }} parameter. When manipulated, this allows untrusted code execution through issue comments, leading to severe security risks.
With this vulnerability, an attacker could potentially gain access to the GITHUB_TOKEN, which has write permissions on your repository. This could lead to a complete takeover of your project, jeopardizing not just your data, but your entire workflow. It's as if they walked right in and started rearranging everything without your permission! To fix this vulnerability, ensure you update to the latest commit (3f61e79) immediately. Additionally, review your workflows to avoid executing code from untrusted sources. Implement stricter checks on issue comments to maintain security. 🛡️ You've got this! With these steps, your repository will be secure and sound in no time. 🚀