CVE-2024-42471

Name of the Vulnerable Software and Affected Versions actions/artifact versions 2.0.0 through 2.1.1 actions/artifact versions 2.1.2 through 2.1.6

Description The issue concerns arbitrary file write when using downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to a newer version to mitigate the risk.

Recommendations For actions/artifact versions 2.0.0 through 2.1.1, upgrade to version 2.1.2 or higher. For actions/artifact versions 2.1.2 through 2.1.6, upgrade to version 2.1.7 or higher. As a temporary workaround, consider disabling the downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal functions until a patch is available. Restrict access to the vulnerable actions/artifact module to minimize the risk of exploitation.