Attributed metadata history
Up to 100 retained publisher events per page for d1a57234cd06c95d9f4cc92b010a0db3ebd0cdda28a16b1a3e4c74965495dd9e. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
The @actions/core package had a delimiter injection vulnerability in the exportVariable function. Attackers could use a known delimiter to break out of a specific variable and assign values to other arbitrary variables. This may have allowed modification of path or environment variables without the intention of workflow or action authors.
Fingerprint: 55fe897d0d00a9a40c9f3c42ade72a4767fe8eb5baba767ade6ff3fd8e0aae2f