Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions marked could run unauthorized code
published 3 months ago
Summary
The "marked" component used in GitHub Actions contains a security weakness that could let an attacker execute code they shouldn’t be able to. The problem has been corrected in the updated version 4.0.6‑tuxcare.1. Apply this update as soon as possible to keep your workflows safe.
What to do
- Update GitHub Actions marked to version 4.0.6-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | marked |
>= 4.0.6-tuxcare.0, < 4.0.6-tuxcare.1 Fix: upgrade to 4.0.6-tuxcare.1
|
Original advisory text
TuxCare security update for marked (1 CVE)
TuxCare rebuilt marked to address 1 CVE. Fixed in 4.0.6-tuxcare.1.
Timeline
Published4 Aug 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLSA-2026-1777077481 · OSV
Track software like this
Free during beta