GHSA-cxww-7g56-2vh6: @actions/download-artifact has an Arbitrary File Write via artifact extraction

Impact

Versions of actions/download-artifact before 4.1.7 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.

Patches

Upgrade to version 4.1.7 or higher. Alternatively use ‘v4’ tag which points to the latest and secure version.

References

• https://snyk.io/research/zip-slip-vulnerability
• https://github.com/actions/download-artifact/releases/tag/v4.1.7

CVE

CVE-2024-42471

Credits

Justin Taft from Google