CVE-2024-42471

npm/@actions/artifact CVE-2024-42471: high 7.3, EPSS 3.22%

@actions/artifact has an Arbitrary File Write via artifact extraction

Action: Upgrade @actions/artifact to 2.1.2 or later.

npm i @actions/artifact@2.1.2

Affected

Fixed versions

Sources

• osv: GHSA-6q32-hq47-5qq3
• https://github.com/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3
• https://nvd.nist.gov/vuln/detail/CVE-2024-42471
• https://github.com/actions/toolkit/pull/1602
• https://github.com/actions/toolkit/pull/1666
• https://github.com/actions/toolkit/pull/1724
• https://github.com/actions/toolkit/commit/29885a805ef3e95a9862dcaa8431c30981960017
• https://github.com/actions/download-artifact/blob/v3/package.json#L31
• https://github.com/actions/toolkit
• https://snyk.io/research/zip-slip-vulnerability

CVE-2024-42471 · published 2024-09-03T20:08:30Z · modified 2025-01-22T18:44:59Z · JSON