What’s Vulnerable › Vulnerabilities

CVE-2023-34112: JavaCPP project actions vulnerable to code injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-09 · updated 2026-06-17
• Weakness: CWE-94

Description

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.

Affected products

• bytedeco javacpp-presets: before 1.5.9 — fixed in 1.5.9

How to fix

Upgrade to a fixed version: bytedeco javacpp-presets 1.5.9. Check the vendor advisory for mitigations.

References

• https://github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x
• https://securitylab.github.com/research/github-actions-untrusted-input/
• https://github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x
• https://securitylab.github.com/research/github-actions-untrusted-input/

Get alerted when CVE-2023-34112 or the next vulnerability affects your stack