gluestack-ui discussion-to-slack.yml command injection

Summaryinfo

A vulnerability was found in gluestack-ui. It has been declared as critical. Impacted is an unknown function of the file discussion-to-slack.yml. Executing a manipulation can lead to command injection. This vulnerability is tracked as CVE-2025-53104. The attack can be launched remotely. No exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in gluestack-ui (version now known) and classified as critical. This vulnerability affects some unknown processing of the file discussion-to-slack.yml. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields (title, body, etc.) were directly interpolated into shell commands in a run: block. An attacker could craft a malicious GitHub Discussion title or body (e.g., $(curl ...)) to execute arbitrary shell commands on the Actions runner. This issue has been fixed in commit e6b4271 where the discussion-to-slack.yml workflow was removed. Users should remove the discussion-to-slack.yml workflow if using a fork or derivative of this repository.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-53104 since 06/25/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Applying the patch e6b4271 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19665). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• gluestack-ui

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion