CVE-2023-51664 - CVE House
Back to Database
Status published High CVE-2023-51664

tj-actions/changed-files command injection in output filenames

Vulnerability Description

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-51664

Credits & Attribution

No credits recorded in the NVD database.

References

More from tj-actions

View All →
CVE-2025-54416
tj-actions/branch-names Contains Command Injection Vulnerability
Critical 9.1
CVE-2025-30066
tj-actions changed-files before 46 allows remote attackers to discover secrets...
High 8.6
CVE-2023-52137
GitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames
High 7.7
CVE-2023-49291
Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
Critical 9.3

Affected Vendor

Affected Software

changed-files
Vulnerable Versions:
< 41.0.0

Timeline

Official Publish: December 27th, 2023
Last Modified: September 25th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-77 CWE-74

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1105 Ingress Tool Transfer
Command and Control
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection