{"cve":"CVE-2021-21423","nvd":{"published":"2021-04-06T19:15:14.787","modified":"2026-06-17T03:35:32.807","status":"Modified","description":"`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the \"main\" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the \"main\" repository. The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made). Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-527"],"references":["https://github.com/projen/projen/commit/36030c6a4b1acd0054673322612e7c70e9446643","https://github.com/projen/projen/security/advisories/GHSA-gg2g-m5wc-vccq","https://www.npmjs.com/package/projen","https://github.com/projen/projen/commit/36030c6a4b1acd0054673322612e7c70e9446643","https://github.com/projen/projen/security/advisories/GHSA-gg2g-m5wc-vccq"],"products":["projen_project:projen"],"source":"nvd","synced_at":"2026-10-19T21:17:01.373894544+00:00"},"epss":{"cve":"CVE-2021-21423","score":0.01392,"percentile":0.72368,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-gg2g-m5wc-vccq","url":"https://osv.dev/vulnerability/GHSA-gg2g-m5wc-vccq","summary":"Rebuild-bot workflow may allow unauthorised repository modifications","modified":"2026-07-08T06:27:36.747299841Z","packages":[{"ecosystem":"npm","name":"projen","purl":"pkg:npm/projen","ranges":[">=0.6.0 <0.16.41"],"fixed":["0.16.41"]},{"ecosystem":"PyPI","name":"projen","purl":"pkg:pypi/projen","ranges":["<0.16.41"],"fixed":["0.16.41"]}]},{"id":"PYSEC-2021-111","url":"https://osv.dev/vulnerability/PYSEC-2021-111","summary":"","modified":"2023-11-08T04:04:45.525339Z","packages":[{"ecosystem":"PyPI","name":"projen","purl":"pkg:pypi/projen","ranges":["<0.16.41"],"fixed":["0.16.41"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}