Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions undici may allow attackers to run code
published 2 days ago
Summary
The undici library used in GitHub Actions had two security issues that could let a malicious user execute code on your system. The problems have been fixed in the updated version 6.28.0-tuxcare.4. Apply this update to keep your workflows safe.
What to do
- Update GitHub Actions undici to version 6.28.0-tuxcare.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | undici |
>= 6.28.0-tuxcare.0, < 6.28.0-tuxcare.4 Fix: upgrade to 6.28.0-tuxcare.4
|
Original advisory text
TuxCare security update for undici (2 CVEs)
TuxCare rebuilt undici to address 2 CVEs. Fixed in 6.28.0-tuxcare.4.
Timeline
Published2 Nov 2026
Updated2 Nov 2026
First seen2 Nov 2026
Sources
CLSA-2026-1793630553 · OSV
Track software like this
Free during beta