VYPR
Get started
← All advisories
Critical severity9.1NVD Advisory· Published Jul 26, 2025· Updated Apr 15, 2026

CVE-2025-54416

CVE-2025-54416

Description

tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tj-actions/branch-namesGitHub Actions
< 9.0.09.0.0

Patches

1
e497ceb8ccd4

security: fix unsafe outputs (#420)

https://github.com/tj-actions/branch-namesTonye JackJul 25, 2025via ghsa
commit
1 file changed · +7 −8
  • action.yml+7 −8 modified
    @@ -64,7 +64,7 @@ runs:
           HEAD_REF=${HEAD_REF/refs\/heads\//}
           REF_BRANCH=${REF/refs\/pull\//}
           REF_BRANCH=${REF_BRANCH/refs\/heads\//}
-          
+
           # Strip branch prefix if provided
           REF_BRANCH=${REF_BRANCH/$INPUTS_STRIP_BRANCH_PREFIX/}
           HEAD_REF=${HEAD_REF/$INPUTS_STRIP_BRANCH_PREFIX/}
@@ -76,19 +76,18 @@ runs:
             REF_BRANCH=${REF_BRANCH//\//-}
           fi
 
-          echo "base_ref_branch=$(eval printf "%s" "$BASE_REF")" >> "$GITHUB_OUTPUT"
-          echo "head_ref_branch=$(eval printf "%s" "$HEAD_REF")" >> "$GITHUB_OUTPUT"
-          echo "ref_branch=$(eval printf "%s" "$REF_BRANCH")" >> "$GITHUB_OUTPUT"
+          printf "base_ref_branch=%s\n" "$BASE_REF" >> "$GITHUB_OUTPUT"
+          printf "head_ref_branch=%s\n" "$HEAD_REF" >> "$GITHUB_OUTPUT"
+          printf "ref_branch=%s\n" "$REF_BRANCH" >> "$GITHUB_OUTPUT"
         else
           BASE_REF=$(printf "%q" "$GITHUB_EVENT_BASE_REF")
           BASE_REF=${BASE_REF/refs\/heads\/$INPUTS_STRIP_TAG_PREFIX/}
-          
+
           # Replace slashes with hyphens if enabled
           if [[ "$INPUTS_REPLACE_SLASHES" == "true" ]]; then
             BASE_REF=${BASE_REF//\//-}
           fi
-          
-          echo "base_ref_branch=$(eval printf "%s" "$BASE_REF")" >> "$GITHUB_OUTPUT"
+          printf "base_ref_branch=%s\n" "$BASE_REF" >> "$GITHUB_OUTPUT"
         fi
       shell: bash
     - id: current_branch
@@ -141,7 +140,7 @@ runs:
             TAG=${TAG//\//-}
           fi
 
-          echo "tag=$(eval printf "%s" "$TAG")" >> "$GITHUB_OUTPUT"
+          printf "tag=%s\n" "$TAG" >> "$GITHUB_OUTPUT"
           echo "is_tag=true" >> "$GITHUB_OUTPUT"
         else
           echo "is_tag=false" >> "$GITHUB_OUTPUT"

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.