CVE-2022-35954: Delimiter Injection Vulnerability in @actions/core
Summary
CVE-2022-35954: @actions/core has Delimiter Injection Vulnerability in exportVariable. Affects @actions/core versions < 1.9.1. Fixed in 1.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @actions/core package is an essential component of GitHub Actions, providing a set of functions and utilities for creating workflows and interacting with the GitHub platform. It allows users to define and automate various tasks within their software development workflows. However, a vulnerability has been discovered in the exportVariable function of @actions/core, which can be exploited by attackers to manipulate environment variables and potentially modify unintended variables.
Vulnerability Detail
The exportVariable function in @actions/core uses a delimiter that can be abused by attackers to break out of the intended variable and assign values to other arbitrary variables. This can lead to unintended modifications of environment variables, including the path variable, which may have serious consequences for the execution of workflows and actions. Workflows that accept untrusted input and write it to the GITHUB_ENV file are particularly vulnerable to this issue.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
npm install @actions/core@3.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.1
This is the first release that contains the fix.
npm install @actions/core@1.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 1.9.1 is not feasible, users can implement a workaround by ensuring that any user input provided to the exportVariable function does not contain the delimiter 'GitHubActionsFileCommandDelimeter' before calling the function. This can be achieved by validating and sanitizing user input before passing it to the exportVariable function.
Conclusion
The delimiter injection vulnerability in @actions/core can have significant implications for the execution of workflows and actions in GitHub Actions. It is crucial for users to upgrade to version 1.9.1 of the @actions/core package or implement the recommended workaround to mitigate the vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @actions/core →
FAQ
The vulnerability allows attackers to modify environment variables, potentially leading to unintended modifications of the path variable and other variables. This can disrupt the execution of workflows and actions and may have security implications.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this specific vulnerability.
There are no known exploits of this vulnerability at the time of this advisory. However, it is important to address the vulnerability promptly to prevent any potential misuse or exploitation.
Yes, you can mitigate the vulnerability by ensuring that user input provided to the exportVariable function does not contain the delimiter 'GitHubActionsFileCommandDelimeter'. This can be done by validating and sanitizing user input before passing it to the function.
You can refer to the GitHub Actions documentation on setting environment variables in workflows for more information. The documentation provides detailed guidance on how to set environment variables securely and effectively.
References
Related vulnerabilities
Recent vulnerabilities recorded for @actions/core.
