Critical · published August 5, 2025
🚨 An attacker can exploit a single comment to execute malicious code in a privileged context! 😱 Think of it like a restaurant where a diner can sneak in a recipe pretending it’s a dish they actually ordered — the chef never checks where the order came from, and suddenly, harmful ingredients are on everyone’s plates. This vulnerability could lead to devastating consequences: an attacker could extract sensitive secrets like GITHUB_TOKEN and NPM_TOKEN, potentially allowing them to push malicious code directly to the repository or even publish compromised packages to the NPM registry. In the wrong hands, this means your code and environment could be at serious risk!
Think of it like a restaurant where a diner can sneak in a recipe pretending it’s a dish they actually ordered — the chef never checks where the order came from, and suddenly, harmful ingredients are on everyone’s plates. Versions 0.9.2 and below of the react-native-bottom-tabs library improperly utilized the pull_request_target event trigger in the GitHub Actions workflow, allowing untrusted code from forked pull requests to run in a context with elevated privileges.
This vulnerability could lead to devastating consequences: an attacker could extract sensitive secrets like GITHUB_TOKEN and NPM_TOKEN, potentially allowing them to push malicious code directly to the repository or even publish compromised packages to the NPM registry. In the wrong hands, this means your code and environment could be at serious risk! Remove the affected github/workflows/release-canary.yml file immediately. Monitor for updates and move to a safe version as soon as a fix is released. In the meantime, review any recent pull requests for suspicious activity and tighten your repository security settings. You've got this! With these steps, you can bolster your defenses and keep your projects safe! 🛡️