We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-54430

dedupe is vulnerable to secret exfiltration via `issue_comment`



Description

dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issue_comment can be triggered using the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }}, which correspond to the branch of the PR manipulated by potentially malicious actors, and where untrusted code may be executed. Running untrusted code may lead to the exfiltration of GITHUB_TOKEN, which in this workflow has write permissions on most of the scopes - in particular the contents one - and could lead to potential repository takeover. This is fixed by commit 3f61e79.

Reserved 2025-07-21 | Published 2025-07-30 | Updated 2025-07-30 | Assigner GitHub_M


CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

< 3f61e79102910bd355e920a2df7e44c14c9cb247
affected

References

github.com/...dedupe/security/advisories/GHSA-wrg3-xqw8-m85p

github.com/...ommit/3f61e79102910bd355e920a2df7e44c14c9cb247

cve.org (CVE-2025-54430)

nvd.nist.gov (CVE-2025-54430)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-54430

Support options

Helpdesk Chat, Email, Knowledgebase