Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then performs a 'dangerous' checkout of the attacker-submitted pull request code (via the dangerous-git-checkout action) and subsequently executes it (through yarn install and package.json scripts). An attacker can open a pull request whose code runs arbitrary commands with the repository's write-scoped GITHUB_TOKEN, allowing them to push commits, merge or mutate pull requests, add or delete comments, and delete or force-push branches, thereby compromising the repository. The main branch is affected; no patched version is available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
Critical GHA flaw (CVE-2024-58354) allows repo takeover via `pull_request_target`. Review `GITHUB_TOKEN` perms now to prevent supply chain attacks. #githubactions #supplychainsecurity #cve #devsecops
Post summary
A critical GitHub Actions vulnerability (CVE-2024-58354) permits repository takeover through the pull_request_target workflow; users are advised to review and restrict GITHUB_TOKEN permissions.
CVE-2024-58354 Repository Takeover via Unsafe GitHub Actions Workflow in http://cal.com https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-58354 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A new vulnerability (CVE‑2024‑58354) targeting unsafe GitHub Actions workflows at cal.com has been disclosed; the post lists the issue type but offers no Proof‑of‑Concept, exploit, patch, or evidence of active exploitation.
🚨*CVE* CVE-2024-58354 http://cal.com (calcom repository, later renamed http://cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pu… https://www.cve.org/CVERecord?id=CVE-2024-58354 ----… http://infoflow.cloud`
Post summary
CVE-2024-58354 describes a repository takeover issue in the cal.com (later cal.diy) GitHub Actions workflow, specifically the pr.yml workflow.
CVE-2024-58354 http://cal.com (calcom repository, later renamed http://cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pu… https://www.cve.org/CVERecord?id=CVE-2024-58354
Post summary
The passage announces CVE-2024-58354 as a repository takeover vulnerability affecting Cal.com's GitHub Actions workflow 'pr.yml', providing limited technical detail but no PoC, exploit, patch, or evidence of active exploitation.