{"action":"Upgrade @actions/artifact to 2.1.2 or later.","affected":[{"fixed":"2.1.2","introduced":"2.0.0"}],"component":"@actions/artifact","cve_ids":["CVE-2024-42471"],"ecosystem":"npm","epss":0.03219,"exploited":false,"fixed_versions":["2.1.2"],"ghsa_id":"GHSA-6q32-hq47-5qq3","id":"tcs_01M5KF7MZZ9W61N3KA1Z4AW7GS","modified_at":"2025-01-22T18:44:59Z","published_at":"2024-09-03T20:08:30Z","references":["https://osv.dev/vulnerability/GHSA-6q32-hq47-5qq3","https://github.com/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3","https://nvd.nist.gov/vuln/detail/CVE-2024-42471","https://github.com/actions/toolkit/pull/1602","https://github.com/actions/toolkit/pull/1666","https://github.com/actions/toolkit/pull/1724","https://github.com/actions/toolkit/commit/29885a805ef3e95a9862dcaa8431c30981960017","https://github.com/actions/download-artifact/blob/v3/package.json#L31","https://github.com/actions/toolkit","https://snyk.io/research/zip-slip-vulnerability"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-6q32-hq47-5qq3","url":"https://osv.dev/vulnerability/GHSA-6q32-hq47-5qq3"}],"summary":"@actions/artifact has an Arbitrary File Write via artifact extraction"}