CVE-2025-61584

serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31.

CVSS

No CVSS.

References

Link	Resource
https://github.com/serverless-dns/serverless-dns/commit/c5537dd7f203c59f2b86d1e295c2371f3533946a
https://github.com/serverless-dns/serverless-dns/security/advisories/GHSA-9g7x-737f-5xpc

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) serverless-dns es un resolvedor de RethinkDNS que se despliega en Cloudflare Workers, Deno Deploy, Fastly y Fly.io. Las versiones hasta e incluyendo la 0.1.30 tienen una vulnerabilidad donde la Acción de GitHub pr.yml interpola de manera insegura entrada no confiable, específicamente github.event.pull_request.head.repo.clone_url y github.head_ref, a un comando en el ejecutor. Debido a que la acción utiliza el disparador pull_request_target, tiene permisos permisivos por defecto. Un atacante no autorizado puede explotar esta vulnerabilidad para enviar datos arbitrarios al repositorio. El impacto subsiguiente en el usuario final es la ejecución del código del atacante al ejecutar serverless-dns. Esto está corregido en el commit c5537dd, y se espera que sea lanzado en la 0.1.31.

30 Sep 2025, 11:37

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-09-30 11:37

Updated : 2026-06-17 09:50

NVD link : CVE-2025-61584

Mitre link : CVE-2025-61584

CVE.ORG link : CVE-2025-61584

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-61584", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61584", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T13:33:48.025979Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "serverless-dns", "product": "serverless-dns", "versions": [{"status": "affected", "version": "< 0.1.31"}]}]}], "published": "2025-09-30T11:37:41.910", "references": [{"url": "https://github.com/serverless-dns/serverless-dns/commit/c5537dd7f203c59f2b86d1e295c2371f3533946a", "source": "security-advisories@github.com"}, {"url": "https://github.com/serverless-dns/serverless-dns/security/advisories/GHSA-9g7x-737f-5xpc", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31."}, {"lang": "es", "value": "serverless-dns es un resolvedor de RethinkDNS que se despliega en Cloudflare Workers, Deno Deploy, Fastly y Fly.io. Las versiones hasta e incluyendo la 0.1.30 tienen una vulnerabilidad donde la Acci\u00f3n de GitHub pr.yml interpola de manera insegura entrada no confiable, espec\u00edficamente github.event.pull_request.head.repo.clone_url y github.head_ref, a un comando en el ejecutor. Debido a que la acci\u00f3n utiliza el disparador pull_request_target, tiene permisos permisivos por defecto. Un atacante no autorizado puede explotar esta vulnerabilidad para enviar datos arbitrarios al repositorio. El impacto subsiguiente en el usuario final es la ejecuci\u00f3n del c\u00f3digo del atacante al ejecutar serverless-dns. Esto est\u00e1 corregido en el commit c5537dd, y se espera que sea lanzado en la 0.1.31."}], "lastModified": "2026-06-17T09:50:36.190", "sourceIdentifier": "security-advisories@github.com"}