Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Undici could allow remote code execution
published 2 months ago
Summary
The undici library used in GitHub Actions can be exploited to run code on your system. This risk has been fixed in the updated version 5.29.0-tuxcare.5. Apply the update as soon as possible to keep your workflows safe.
What to do
- Update GitHub Actions undici to version 5.29.0-tuxcare.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | undici |
>= 5.29.0-tuxcare.0, < 5.29.0-tuxcare.5 Fix: upgrade to 5.29.0-tuxcare.5
|
Original advisory text
TuxCare security update for undici (2 CVEs)
TuxCare rebuilt undici to address 2 CVEs. Fixed in 5.29.0-tuxcare.5.
Timeline
Published10 Aug 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLSA-2026-1786370674 · OSV
Track software like this
Free during beta