Skip to main content

Early Access — Mondoo Vulnerability Intelligence is currently in preview.

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

CVE-2024-48908

MEDIUM6.9

lychee-action vulnerable to arbitrary code injection in composite action

Published Aug 28, 2025

Modified 4 months ago

No fix available

Details

lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.

References

WEBhttps://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede WEBhttps://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2024-48908

CVSS Analysis

CVSS v4.0

6.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

6.9/CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Weakness Type (CWE)

Injection

Ecosystems

Timeline

PublishedAug 28, 2025

ModifiedAug 28, 2025

CVE-2024-48908 | Mondoo Vulnerability Intelligence