CVE-2023-34112

HOCH 8.8CVE-2023-34112 · Published 09/06/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-34112 ist eine Schwachstelle (HOCH (CVSS 8.8)) in javacpp presets (bytedeco).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.9%, höher als bei 80.3% aller Schwachstellen.
Abhilfe: auf 1.5.9 oder neuer aktualisieren.

Package	Affected versions	Patched versions
javacpp presets bytedeco	`< 1.5.9`	`1.5.9`

Description

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.

References

bytedeco/javacpp-presets security advisory · Vendor Advisory
securitylab.github.com/research/github-actions-untrusted-input · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free