Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions create-next-app can let attackers run code
published 19 days ago
Summary
The create‑next‑app tool used in GitHub Actions could allow a malicious user to execute unwanted code on your build server. This could lead to unauthorized changes or data exposure. Upgrade to the latest version (15.5.23‑tuxcare.1) as soon as possible to close the risk.
What to do
- Update GitHub Actions create-next-app to version 15.5.23-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | create-next-app |
>= 15.5.23-tuxcare.0, < 15.5.23-tuxcare.1 Fix: upgrade to 15.5.23-tuxcare.1
|
Original advisory text
TuxCare security update for create-next-app (1 CVE)
TuxCare rebuilt create-next-app to address 1 CVE. Fixed in 15.5.23-tuxcare.1.
Timeline
Published17 Oct 2026
Updated17 Oct 2026
First seen17 Oct 2026
Sources
CLSA-2026-1792195717 · OSV
Track software like this
Free during beta