CVE-2025-53546 - CVE House
Back to Database
Status published Critical CVE-2025-53546

Folo allows secrets exfiltration via `pull_request_target`

Vulnerability Description

Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53546

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

Folo
Vulnerable Versions:
< 585c6a591440cd39f92374230ac5d65d7dd23d6a

Timeline

Official Publish: July 9th, 2025
Last Modified: July 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-829

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.