High severity7.3NVD Advisory· Published Dec 27, 2023· Updated Jun 17, 2026
CVE-2023-51664
CVE-2023-51664
Description
tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tj-actions/changed-filesGitHub Actions | < 41 | 41 |
Affected products
2- Range: < 41.0.0
Patches
Vulnerability mechanics
References
6- github.com/tj-actions/changed-files/commit/0102c07446a3cad972f4afcbd0ee4dbc4b6d2d1bnvdPatchWEB
- github.com/tj-actions/changed-files/commit/716b1e13042866565e00e85fd4ec490e186c4a2fnvdPatchWEB
- github.com/tj-actions/changed-files/commit/ff2f6e6b91913a7be42be1b5917330fe442f2edenvdPatchWEB
- github.com/tj-actions/changed-files/security/advisories/GHSA-mcph-m25j-8j63nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-mcph-m25j-8j63ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-51664ghsaADVISORY
News mentions
0No linked articles in our index yet.