CVE-2025-54430
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-54430
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-54430.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-54430
- Aliases
-
- GHSA-wrg3-xqw8-m85p
- Published
- 2025-07-30T14:15:29Z
- Modified
- 2025-07-31T20:50:54.997119Z
- Summary
- [none]
- Details
-
dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issuecomment can be triggered using the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }}, which correspond to the branch of the PR manipulated by potentially malicious actors, and where untrusted code may be executed. Running untrusted code may lead to the exfiltration of GITHUBTOKEN, which in this workflow has write permissions on most of the scopes - in particular the contents one - and could lead to potential repository takeover. This is fixed by commit 3f61e79.
- References
Affected packages
Git / github.com/dedupeio/dedupe
Affected ranges
- Type
- GIT
- Repo
- https://github.com/dedupeio/dedupe
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed