AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AtlassianGHSA-hj6w-pm28-h8hf

gajira-comment GitHub action vulnerable to arbitrary code execution

Atlassian

CVE-2020-14189 · Published Oct 28, 2020 · updated Dec 18, 2020

High
Fix: upgrade to 2.0.2 or later
GitHub advisory

Impact

An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment.

Patches

This issue is patched in gajira-comment version 2.0.2.

Workarounds

There are no known workarounds.

References

[GitHub Security Lab advisory GHSL-2020-173](https://securitylab.github.com/advisories/GHSL-2020-173-gajira-comment-action)

Affected versions

PackageAffectedFixed in
gajira-comment
Product
< 2.0.22.0.2
Details and references
Severity from
GitHub (reviewed advisory)

More Atlassian advisories

All Atlassian
High 7.6Aug 18Atlassian Bamboo Data Center: improper authorizationCVE-2026-21584no fix yetHigh 8.8Aug 18Atlassian Crowd Data Center: improper authenticationCVE-2026-21582no fix yetHigh 8.2Jul 21Atlassian Confluence Data Center: information disclosureCVE-2026-21579no fix yetHigh 7.1Jul 21Atlassian Confluence Data Center: denial of serviceCVE-2026-21577no fix yetHigh 7.1Jul 21Atlassian Sourcetree for Mac: remote code executionCVE-2026-21575no fix yetHighOct 28, 2020gajira-create GitHub action vulnerable to arbitrary code executionCVE-2020-14188fixed in 2.0.1