{"cve":"CVE-2022-35954","nvd":{"published":"2022-08-15T11:21:39.040","modified":"2026-06-17T04:52:35.747","status":"Modified","description":"The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","score":5.0},"cwes":["CWE-74","CWE-77"],"references":["https://github.com/actions/toolkit/commit/4beda9cbc00ba6eefe387a937c21087ccb8ee9df","https://github.com/actions/toolkit/security/advisories/GHSA-7r3h-m5j6-3q42","https://github.com/actions/toolkit/commit/4beda9cbc00ba6eefe387a937c21087ccb8ee9df","https://github.com/actions/toolkit/security/advisories/GHSA-7r3h-m5j6-3q42"],"products":["github:toolkit"],"source":"nvd","synced_at":"2026-10-19T21:34:18.502168378+00:00"},"epss":{"cve":"CVE-2022-35954","score":0.00704,"percentile":0.5334,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7r3h-m5j6-3q42","url":"https://osv.dev/vulnerability/GHSA-7r3h-m5j6-3q42","summary":"@actions/core has Delimiter Injection Vulnerability in exportVariable","modified":"2023-11-08T04:09:54.141459Z","packages":[{"ecosystem":"npm","name":"@actions/core","purl":"pkg:npm/%40actions/core","ranges":["<1.9.1"],"fixed":["1.9.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}