CVE-2024-48908
MEDIUM EPSS 27.8%
Published Aug 28, 202510mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Published Aug 28, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago
Description
lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
27.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
References 2
- github.com https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede
- github.com https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.