AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AtlassianGHSA-4xqx-pqpj-9fqw

gajira-create GitHub action vulnerable to arbitrary code execution

Atlassian

CVE-2020-14188 · Published Oct 28, 2020 · updated Dec 18, 2020

High
Fix: upgrade to 2.0.1 or later
GitHub advisory

Impact

An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue.

Patches

This issue is patched in gajira-create version 2.0.1.

Workarounds

There are no known workarounds.

References

[GitHub Security Lab advisory GHSL-2020-172](https://securitylab.github.com/advisories/GHSL-2020-172-gajira-create-action)

Affected versions

PackageAffectedFixed in
gajira-create
Product
< 2.0.12.0.1
Details and references
Severity from
GitHub (reviewed advisory)

More Atlassian advisories

All Atlassian
High 7.6Aug 18Atlassian Bamboo Data Center: improper authorizationCVE-2026-21584no fix yetHigh 8.8Aug 18Atlassian Crowd Data Center: improper authenticationCVE-2026-21582no fix yetHigh 8.2Jul 21Atlassian Confluence Data Center: information disclosureCVE-2026-21579no fix yetHigh 7.1Jul 21Atlassian Confluence Data Center: denial of serviceCVE-2026-21577no fix yetHigh 7.1Jul 21Atlassian Sourcetree for Mac: remote code executionCVE-2026-21575no fix yetHighOct 28, 2020gajira-comment GitHub action vulnerable to arbitrary code executionCVE-2020-14189fixed in 2.0.2