What’s Vulnerable › Vulnerabilities

CVE-2024-48908: lychee-action vulnerable to arbitrary code injection in composite action

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-28 · updated 2026-09-26
• Weakness: CWE-94

Description

lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.

Affected products

• lycheeverse lychee-action: before 2.0.2

References

• https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede
• https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x

Get alerted when CVE-2024-48908 or the next vulnerability affects your stack