CVE-2024-48908 in lychee-action
Summary
by MITRE • 08/28/2025
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2025
The vulnerability identified as CVE-2024-48908 affects the lychee link checking action, a composite GitHub Action designed to validate links within Markdown, HTML, and text files. This tool operates as part of continuous integration workflows, automatically scanning documentation and content for broken links. The flaw specifically resides in the lychee-setup component of the composite action configuration file action.yml, where improper input validation creates a path for malicious actors to inject arbitrary code during the action execution process. The vulnerability represents a critical security risk within software development pipelines, particularly affecting organizations that rely on automated documentation validation and link checking.
The technical implementation of this vulnerability stems from insufficient sanitization of inputs passed to the lychee-setup composite action. When users configure the action in their workflow files, parameters such as repository paths, file patterns, or configuration options are processed without adequate validation or escaping mechanisms. This allows attackers who can influence these parameters to inject malicious commands that get executed within the context of the GitHub Actions runner. The vulnerability aligns with CWE-74, which describes improper neutralization of special elements used in data queries, and CWE-94, which covers improper control of generation of code. The attack vector specifically targets the action.yml configuration file where the composite action is defined, making it a supply chain security concern that affects all users of the affected versions.
The operational impact of this vulnerability extends beyond simple link checking failures, as it provides a potential pathway for attackers to execute arbitrary code on GitHub Actions runners. This could enable malicious actors to access sensitive repository data, steal secrets stored in the environment, or perform unauthorized operations against the infrastructure. The vulnerability affects the integrity of development workflows and could lead to supply chain compromises where legitimate documentation checking actions become vectors for malicious code execution. Organizations using lychee in their CI/CD pipelines are at risk of having their automated processes subverted, potentially leading to data breaches or unauthorized access to development environments. The issue represents a significant concern for security-conscious organizations that depend on automated validation processes for their documentation and content management workflows.
The remediation for CVE-2024-48908 requires immediate upgrading to version 2.0.2 or later of the lychee link checking action. Organizations should review their existing workflows to ensure they are not using vulnerable versions and update their action references accordingly. Security teams should monitor for any unauthorized access or suspicious activities in their GitHub repositories following the patch deployment. Additionally, administrators should implement proper input validation practices for any custom composite actions within their organizations and consider implementing additional security controls such as code scanning and dependency review features. The fix addresses the root cause by implementing proper input sanitization and command execution mechanisms within the lychee-setup component, preventing the injection of malicious code through configuration parameters. This vulnerability serves as a reminder of the importance of securing CI/CD pipeline components and maintaining up-to-date dependencies to prevent supply chain attacks that could compromise entire development ecosystems.