pvharmo2/gha-lab-6ab39df295Controlled security-research lab reproducing CVE-2024-45798 (GHSA-h52q-xhg2-6jw8) in espressif/arduino-esp32 — poisoned-artifact pwn request via tests_results.yml workflow_run
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
espressif/arduino-esp32at commit9e60bbe4bc05e8d27050d23ce3a61a955c1851eb(2024-09-13), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2024-09-13; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
Latest Stable Release 
Latest Development Release 
Our Development is fully tracked on this public Roadmap 🎉
For even more information you can join our Monthly Community Meetings 🔔.
You can use the Arduino-ESP32 Online Documentation to get all information about this project.
Migration guide from version 2.x to 3.x is available here.
APIs compatibility with ESP8266 and Arduino-CORE (Arduino.cc) is explained here.
Here are the ESP32 series supported by the Arduino-ESP32 project:
[!NOTE] ESP32-C2 is also supported by Arduino-ESP32 but requires rebuilding the static libraries. This is not trivial and requires a good understanding of the ESP-IDF build system. For more information, see the Lib Builder documentation.
For more details visit the supported chips documentation page.
You can use EspExceptionDecoder to get meaningful call trace.
Before reporting an issue, make sure you've searched for similar one that was already created. Also make sure to go through all the issues labeled as Type: For reference.
Finally, if you are sure no one else had the issue, follow the Issue template or Feature request template while reporting any new Issue.
We have set-up CI testing for external libraries for ESP32 Arduino core. You can check test results in the file LIBRARIES_TEST. For more information and how to add your library to the test see external library testing in the documentation.
We welcome contributions to the Arduino ESP32 project!
See contributing in the documentation for more information on how to contribute to the project.
We would like to have this repository in a polite and friendly atmosphere, so please be kind and respectful to others. For more details, look at Code of Conduct.
