Vulnerable Use of actions/download-artifact@v1 in CI – Arbitrary File Write via CVE-2024-42471

[vishalkumar957039]

Hii

The GitHub Actions workflow in the FoXAI repository is using a vulnerable version of actions/download-artifact@v2, which is affected by CVE-2024-42471. This vulnerability allows attackers to exploit artifact extraction to overwrite arbitrary files on the GitHub runner. This could lead to remote code execution, workflow manipulation, or leakage of secrets.

📍 Vulnerable usage:
FoXAI: publish_docs.yaml#L87

---

How to reproduce?

1. Fork the repository.
2. Push a crafted artifact with directory traversal (../) paths.
3. Trigger the publish_docs workflow.
4. Observe file overwrite on the GitHub-hosted runner.

---

Additional information

• This vulnerability exists in both @v1 and @v2 of the action.

• Recommended patch:
  Replace the usage with the secure version:

  uses: actions/download-artifact@v4

• Severity: High, especially for public or fork-enabled repositories.

---

🔗 References:

• GitHub Advisory: GHSA-6q32-hq47-5qq3
• CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2024-42471