PT-2025-35094
CVE-2024-48908
·
Published
2025-08-28
·
Updated
2026-09-26
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Name of the Vulnerable Software and Affected Versions:
lychee link checking action versions prior to 2.0.2
Description:
The GitHub Action variable
inputs.lycheeVersion can be used to execute arbitrary code in the context of the action. This can potentially compromise the security of the target repository. The issue resides in lychee-setup of the composite action at action.yml.Recommendations:
Update to version 2.0.2 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾