{"action":"Upgrade @actions/http-client to 1.0.8 or later.","affected":[{"fixed":"1.0.8","introduced":"0"}],"component":"@actions/http-client","cve_ids":["CVE-2020-11021"],"ecosystem":"npm","epss":0.01781,"exploited":false,"fixed_versions":["1.0.8"],"ghsa_id":"GHSA-9w6v-m7wp-jwg4","id":"tcs_01M5KFH3DPRADDH3P3E15M39G1","modified_at":"2026-07-08T06:00:04.038902356Z","published_at":"2020-04-29T17:58:53Z","references":["https://osv.dev/vulnerability/GHSA-9w6v-m7wp-jwg4","https://github.com/actions/http-client/security/advisories/GHSA-9w6v-m7wp-jwg4","https://nvd.nist.gov/vuln/detail/CVE-2020-11021","https://github.com/actions/http-client/pull/27","https://github.com/actions/http-client/commit/f6aae3dda4f4c9dc0b49737b36007330f78fd53a","https://github.com/actions/http-client"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-9w6v-m7wp-jwg4","url":"https://osv.dev/vulnerability/GHSA-9w6v-m7wp-jwg4"}],"summary":"Http request which redirect to another hostname do not strip authorization header in @actions/http-client"}