CVE-2025-53546

Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/RSSNext/Folo/commit/585c6a591440cd39f92374230ac5d65d7dd23d6a
https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4
https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4

Configurations

No configuration.

History

10 Jul 2025, 13:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-09 15:15

Updated : 2025-07-10 13:17

NVD link : CVE-2025-53546

Mitre link : CVE-2025-53546

CVE.ORG link : CVE-2025-53546

JSON object : View

Products Affected

No product.

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2025-53546", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2025-07-09T15:15:24.787", "references": [{"url": "https://github.com/RSSNext/Folo/commit/585c6a591440cd39f92374230ac5d65d7dd23d6a", "source": "security-advisories@github.com"}, {"url": "https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4", "source": "security-advisories@github.com"}, {"url": "https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a."}, {"lang": "es", "value": "Folo organiza el contenido de los feeds en una sola l\u00ednea de tiempo. El uso de pull_request_target en .github/workflows/auto-fix-lint-format-commit.yml puede ser explotado por atacantes, ya que se puede ejecutar c\u00f3digo no confiable con acceso completo a los secretos (del repositorio base). Al explotar esta vulnerabilidad, es posible exfiltrar GITHUB_TOKEN, que tiene altos privilegios. GITHUB_TOKEN puede usarse para controlar completamente el repositorio, ya que el token tiene privilegios de escritura de contenido. Esta vulnerabilidad est\u00e1 corregida en el commit 585c6a591440cd39f92374230ac5d65d7dd23d6a."}], "lastModified": "2025-07-10T13:17:30.017", "sourceIdentifier": "security-advisories@github.com"}