Git Command Flag Injection in Actions Checkout & Container Mount Handling (nektos/act)

0x01 // Advisory Summary

Improper neutralization of argument delimiters and incomplete denylist handling in nektos/act (< 0.2.95) allow crafted workflow action references or repository inputs to inject arbitrary flags into git subprocess invocations.

0x02 // Affected Versions & Remediation

• Repository: nektos/act
• Affected Versions: < 0.2.95
• Patched Versions: 0.2.95
• CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Reporter Credit: Serhii Shunko (@ccsimplyspolit)

0x03 // Canonical Verification Links

• Official GitHub Security Advisory: https://github.com/nektos/act/security/advisories/GHSA-jpm2-x6wf-fxjc
• Reporter Profile: https://github.com/ccsimplyspolit