Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

pac-resolver package can let bad code run

CVE-2021-23406 · published 1 day ago
Summary

The pac-resolver library used in GitHub Actions and related projects could be tricked into executing unwanted code, potentially affecting your automated workflows. This risk is fixed in newer releases of pac-resolver and the related packages. Install the latest version of pac-resolver (and any dependent packages) to protect your system.

What to do
  • Update GitHub Actions pac-resolver to version 5.0.0.
  • Update GitHub Actions degenerator to version 3.0.1.
  • Update pac-resolver to version 3.0.0-aikido.1.
  • Update rootio @rootio/pac-resolver to version 3.0.0-root.io.1.
  • Update pac-resolver_project pac-resolver to version 5.0.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions pac-resolver < 5.0.0
Fix: upgrade to 5.0.0
npm GitHub Actions degenerator < 3.0.1
Fix: upgrade to 3.0.1
– pac-resolver_project pac-resolver < 5.0.0
cpe:2.3:a:pac-resolver_project:pac-resolver:*:*:*:*:*:node.js:*:*
Root:npm – pac-resolver < 3.0.0-aikido.1
Fix: upgrade to 3.0.0-aikido.1
Root:npm rootio @rootio/pac-resolver < 3.0.0-root.io.1
Fix: upgrade to 3.0.0-root.io.1
Original advisory text
CVE-2021-23406 in pac-resolver - Patched by Root
Root has patched CVE-2021-23406 in the pac-resolver package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published6 Nov 2026
Updated6 Nov 2026
First seen6 Mar 2026
Sources
GHSA-9j49-mfvp-vmhm · GHSA
CVE-2021-23406 · NVD
ROOT-APP-NPM-CVE-2021-23406 · OSV
Track software like this
Free during beta