What’s Vulnerable › Vulnerabilities

CVE-2023-51664: tj-actions/changed-files command injection in output filenames

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-27 · updated 2026-06-17
• Weakness: CWE-74

Description

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.

Affected products

• tj-actions changed-files: before 41.0.0 — fixed in 41.0.0

How to fix

Upgrade to a fixed version: tj-actions changed-files 41.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/tj-actions/changed-files/commit/0102c07446a3cad972f4afcbd0ee4dbc4b6d2d1b
• https://github.com/tj-actions/changed-files/commit/716b1e13042866565e00e85fd4ec490e186c4a2f
• https://github.com/tj-actions/changed-files/commit/ff2f6e6b91913a7be42be1b5917330fe442f2ede
• https://github.com/tj-actions/changed-files/security/advisories/GHSA-mcph-m25j-8j63
• https://github.com/tj-actions/changed-files/commit/0102c07446a3cad972f4afcbd0ee4dbc4b6d2d1b
• https://github.com/tj-actions/changed-files/commit/716b1e13042866565e00e85fd4ec490e186c4a2f
• https://github.com/tj-actions/changed-files/commit/ff2f6e6b91913a7be42be1b5917330fe442f2ede
• https://github.com/tj-actions/changed-files/security/advisories/GHSA-mcph-m25j-8j63

Get alerted when CVE-2023-51664 or the next vulnerability affects your stack