CVE-2022-35954

The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.

• CWE-77
• CWE-74

• https://github.com/actions/toolkit/commit/4beda9cbc00ba6eefe387a937c21087ccb8ee9dfPatch, Third Party Advisory
• https://github.com/actions/toolkit/security/advisories/GHSA-7r3h-m5j6-3q42Third Party Advisory
• https://github.com/actions/toolkit/commit/4beda9cbc00ba6eefe387a937c21087ccb8ee9dfPatch, Third Party Advisory
• https://github.com/actions/toolkit/security/advisories/GHSA-7r3h-m5j6-3q42Third Party Advisory

Published

Aug 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35949undici is an HTTP/1.1 client, written from scratch for Node.…9.8
• CVE-2022-3595A vulnerability was found in Linux Kernel. It has been rated…5.5
• CVE-2022-35950OroCommerce is an open-source Business to Business Commerce …4.8
• CVE-2022-35951Redis is an in-memory database that persists on disk. Versio…9.8
• CVE-2022-35952TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35953BookWyrm is a social network for tracking your reading, talk…6.1
• CVE-2022-35956This Rails gem adds two methods to the ActiveRecord::Base cl…9.8
• CVE-2022-35957Grafana is an open-source platform for monitoring and observ…6.6
• CVE-2022-35958Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-35959TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-3596An information leak was found in OpenStack's undercloud. Thi…7.5
• CVE-2022-35960TensorFlow is an open source platform for machine learning. …7.5