high7.3Public exploit code
CVE-2024-42471
@actions/artifact has an Arbitrary File Write via artifact extraction
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- unzip-stream 0.3.1 - Arbitrary File Write2025-04-30 · local · nodejs
Impact
### Impact Versions of `actions/artifact` before 2.1.7 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. ### Patches Upgrade to version 2.1.7 or higher. ### References - https://snyk.io/research/zip-slip-vulnerability - https://github.com/actions/toolkit/pull/1724 ### CVE CVE-2024-42471 ### Credits Justin Taft from Google
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @actions/artifact | >= 2.0.0, < 2.1.2 | 2.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Github | Actions\/Artifact | from 2.0.0 before 2.1.7 |
| Github | Actions Toolkit | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/actions/toolkit/pull/1666
- https://github.com/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3
- https://snyk.io/research/zip-slip-vulnerability
- https://github.com/advisories/GHSA-6q32-hq47-5qq3
- https://nvd.nist.gov/vuln/detail/CVE-2024-42471
- https://github.com/actions/toolkit/pull/1724
- https://github.com/actions/toolkit/commit/29885a805ef3e95a9862dcaa8431c30981960017
- https://github.com/actions/toolkit/pull/1602
- https://github.com/actions/download-artifact/blob/v3/package.json#L31