We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issue_comment can be triggered using the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }}, which correspond to the branch of the PR manipulated by potentially malicious actors, and where untrusted code may be executed. Running untrusted code may lead to the exfiltration of GITHUB_TOKEN, which in this workflow has write permissions on most of the scopes - in particular the contents one - and could lead to potential repository takeover. This is fixed by commit 3f61e79.
Reserved 2025-07-21 | Published 2025-07-30 | Updated 2025-07-30 | Assigner GitHub_MCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
github.com/...dedupe/security/advisories/GHSA-wrg3-xqw8-m85p
github.com/...ommit/3f61e79102910bd355e920a2df7e44c14c9cb247
Support options