Summary
The current actions/setup-node release bundles brace-expansion versions covered by GHSA-3jxr-9vmj-r5cp, an exponential-time denial-of-service vulnerability.
Current release
v7.0.0 resolves vulnerable versions in its lockfile (entry, 1.x entry, 2.x entry):
brace-expansion 1.1.13brace-expansion 2.1.1brace-expansion 5.0.6
The checked-in dist/setup bundle also includes the brace-expansion implementation. The advisory's patched floors are:
- 1.x:
1.1.16
- 2.x:
2.1.2
- 5.x:
5.0.7
The advisory was published after v7.0.0. I could not find an existing issue or pull request tracking it.
Requested remediation
Please update the affected dependency lines, regenerate the lockfile, rebuild all checked-in dist artifacts, and publish a patched release. Verifying the generated bundle is important because consumers pin and execute the committed JavaScript rather than installing the repository lockfile.
Exploitability depends on whether a workflow exposes brace patterns to untrusted input, but downstream repositories and security scanners still inherit the bundled vulnerable code.
Summary
The current
actions/setup-noderelease bundlesbrace-expansionversions covered by GHSA-3jxr-9vmj-r5cp, an exponential-time denial-of-service vulnerability.Current release
v7.0.0resolves vulnerable versions in its lockfile (entry, 1.x entry, 2.x entry):brace-expansion1.1.13brace-expansion2.1.1brace-expansion5.0.6The checked-in
dist/setupbundle also includes the brace-expansion implementation. The advisory's patched floors are:1.1.162.1.25.0.7The advisory was published after
v7.0.0. I could not find an existing issue or pull request tracking it.Requested remediation
Please update the affected dependency lines, regenerate the lockfile, rebuild all checked-in
distartifacts, and publish a patched release. Verifying the generated bundle is important because consumers pin and execute the committed JavaScript rather than installing the repository lockfile.Exploitability depends on whether a workflow exposes brace patterns to untrusted input, but downstream repositories and security scanners still inherit the bundled vulnerable code.