CVE-2022-29220

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the username and email in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. Version 3.2.0 contains a patch for this issue.

• CWE-283
• CWE-345

• https://github.com/fastify/github-action-merge-dependabot/commit/309f39539c5d918d8a47075587aa8720a9c127f7Patch, Third Party Advisory
• https://github.com/fastify/github-action-merge-dependabot/security/advisories/GHSA-v5vr-h3xq-8v6wThird Party Advisory
• https://hackerone.com/bugs?report_id=1564530Permissions Required, Third Party Advisory
• https://github.com/fastify/github-action-merge-dependabot/commit/309f39539c5d918d8a47075587aa8720a9c127f7Patch, Third Party Advisory
• https://github.com/fastify/github-action-merge-dependabot/security/advisories/GHSA-v5vr-h3xq-8v6wThird Party Advisory
• https://hackerone.com/bugs?report_id=1564530Permissions Required, Third Party Advisory

Published

May 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29215RegionProtect is a plugin that allows users to manage certai…7.5
• CVE-2022-29216TensorFlow is an open source platform for machine learning. …7.8
• CVE-2022-29217PyJWT is a Python implementation of RFC 7519. PyJWT supports…7.5
• CVE-2022-29218RubyGems is a package registry used to supply software for t…7.5
• CVE-2022-29219Lodestar is a TypeScript implementation of the Ethereum Cons…7.5
• CVE-2022-2922Relative Path Traversal in GitHub repository dnnsoftware/dnn…4.9
• CVE-2022-29221Smarty is a template engine for PHP, facilitating the separa…8.8
• CVE-2022-29222Pion DTLS is a Go implementation of Datagram Transport Layer…7.5
• CVE-2022-29223Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-29224Envoy is a cloud-native high-performance proxy. Versions of …5.9
• CVE-2022-29225Envoy is a cloud-native high-performance proxy. In versions …7.5
• CVE-2022-29226Envoy is a cloud-native high-performance proxy. In versions …9.1