CVE-2024-42370

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.

• CWE-78

• https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17
• https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml
• https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b
• https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7

Published

Aug 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42365Asterisk is an open source private branch exchange (PBX) and…8.8
• CVE-2024-42366VRCX is an assistant/companion application for VRChat. In ve…9
• CVE-2024-42367aiohttp is an asynchronous HTTP client/server framework for …4.8
• CVE-2024-42368OpenTelemetry, also known as OTel, is a vendor-neutral open …6.5
• CVE-2024-42369matrix-js-sdk is a Matrix messaging protocol Client-Server S…5.3
• CVE-2024-4237A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-42371The RFC enabled function module allows a low privileged user…5.4
• CVE-2024-42372Due to missing authorization check in SAP NetWeaver AS Java …6.5
• CVE-2024-42373SAP Student Life Cycle Management (SLcM) fails to conduct pr…5.4
• CVE-2024-42374BEx Web Java Runtime Export Web Service does not sufficientl…8.2
• CVE-2024-42375SAP BusinessObjects Business Intelligence Platform allows …4.3
• CVE-2024-42376SAP Shared Service Framework does not perform necessary auth…6.5