CVE-2022-39326

kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the context of the workflow. Users should upgrade to at least version 2.7.5 to resolve the issue. As a workaround, review any pull requests from external users for malicious payloads before allowing them to trigger a build.

• CWE-94
• CWE-94

• https://github.com/kartverket/github-workflows/pull/19Patch, Third Party Advisory
• https://github.com/kartverket/github-workflows/releases/tag/v2.7.5Patch, Release Notes, Third Party Advisory
• https://github.com/kartverket/github-workflows/security/advisories/GHSA-f9qj-7gh3-mhj4Third Party Advisory
• https://github.com/kartverket/github-workflows/pull/19Patch, Third Party Advisory
• https://github.com/kartverket/github-workflows/releases/tag/v2.7.5Patch, Release Notes, Third Party Advisory
• https://github.com/kartverket/github-workflows/security/advisories/GHSA-f9qj-7gh3-mhj4Third Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39320FreeRDP is a free remote desktop protocol library and client…4.6
• CVE-2022-39321GitHub Actions Runner is the application that runs a job fro…9.9
• CVE-2022-39322@keystone-6/core is a core package for Keystone 6, a content…9.8
• CVE-2022-39323GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…9.8
• CVE-2022-39324Grafana is an open-source platform for monitoring and observ…3.5
• CVE-2022-39325BaserCMS is a content management system with a japanese lang…6.1
• CVE-2022-39327Azure CLI is the command-line interface for Microsoft Azure.…9.8
• CVE-2022-39328Grafana is an open-source platform for monitoring and observ…8.1
• CVE-2022-39329Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2022-3933The Essential Real Estate WordPress plugin before 3.9.6 does…5.4
• CVE-2022-39330Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-39331Nexcloud desktop is the Desktop sync client for Nextcloud. A…5.4