Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions pacote may allow unauthorized code execution
published 1 month ago
Summary
The pacote tool used in GitHub Actions contained a security weakness that could let an attacker run code they shouldn't. The issue has been fixed in version 21.5.0‑tuxcare.1. Update to this version as soon as possible to protect your workflows.
What to do
- Update GitHub Actions pacote to version 21.5.0-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | pacote |
< 21.5.0-tuxcare.1 Fix: upgrade to 21.5.0-tuxcare.1
|
Original advisory text
TuxCare security update for pacote (1 CVE)
TuxCare rebuilt pacote to address 1 CVE. Fixed in 21.5.0-tuxcare.1.
Timeline
Published23 Sep 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
CLSA-2026-1790171653 · OSV
Track software like this
Free during beta