CVE-2024-21623

Name of the Vulnerable Software and Affected Versions OTCLient versions prior to commit db560de0b56476c87a2f967466407939196dd254

Description The issue concerns an expression injection vulnerability in the /mehah/otclient "Analysis - SonarCloud" workflow, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow.

Recommendations For versions prior to commit db560de0b56476c87a2f967466407939196dd254, update to a version that includes the fix commit db560de0b56476c87a2f967466407939196dd254 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable "Analysis - SonarCloud" workflow until the update is applied.