Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions undici may let attackers execute code
published 3 months ago
Summary
The undici component used in GitHub Actions had a security weakness that could let an attacker run unwanted code. TuxCare has released a new version, 5.28.5‑tuxcare.1, that corrects the problem. Update to this version as soon as possible to protect your workflows.
What to do
- Update GitHub Actions undici to version 5.28.5-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | undici |
>= 5.28.5-tuxcare.0, < 5.28.5-tuxcare.1 Fix: upgrade to 5.28.5-tuxcare.1
|
Original advisory text
TuxCare security update for undici (1 CVE)
TuxCare rebuilt undici to address 1 CVE. Fixed in 5.28.5-tuxcare.1.
Timeline
Published4 Aug 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLSA-2026-1774484518 · OSV
Track software like this
Free during beta