CVE-2024-42471 json
Arbitrary File Write via artifact extraction in actions/artifact
published 2024-09-02 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2737 , GHSA-6q32-hq47-5qq3
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 1
- Exploit-DB
Summary
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.
Patch / fix
- npm @actions/artifact 2.1.2
- github actions/artifact 2.1.2
- github actions_toolkit 2.1.2
- github toolkit 2.1.2
- toolkit_project toolkit 2.1.2
- github.com/actions/toolkit@29885a8 commit
- github.com/actions/toolkit#1666 pull request
- github.com/actions/toolkit#1602 pull request
- github.com/actions/toolkit#1724 pull request
Timeline
- Published
- First public exploit (EDB-52276)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
3.22% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-52276 unzip-stream 0.3.1 - Arbitrary File Write local, 2025-04-30
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @actions/artifact | >=2.0.0, <2.1.2 |
2.1.2 |
Affected products
- actions toolkit
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/actions/toolkit/pull/1666
web
-
github.com
/actions/toolkit/pull/1602
web
-
github.com
/actions/toolkit/pull/1724
web
-
github.com
/actions/toolkit/commit/29885a805ef3e95a9862dcaa8431c30981960017
web
-
github.com
/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3
web, vendor-advisory
-
snyk.io
/research/zip-slip-vulnerability
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2024-42471
advisory
-
github.com
/actions/download-artifact/blob/v3/package.json#L31
web
-
github.com
/actions/toolkit
package
Sources
- CVE List CVE-2024-42471
- GitHub Advisory GHSA-6q32-hq47-5qq3
- NVD CVE-2024-42471
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.