OZI GitHub Action Code Injection Vulnerability

A code injection vulnerability has been identified in the OZI GitHub Action, specifically in versions 1.13.2 prior to 1.13.5. This vulnerability arises from the PR creation logic, which improperly handles potentially untrusted data. A malicious actor could exploit this by crafting a branch name that injects arbitrary code. The issue has been addressed in version 1.13.6. As a temporary measure, users can downgrade to a version prior to 1.13.2.

Impact

Exploitation of this vulnerability allows for arbitrary code injection, which could be executed in the context of the GitHub Action.

Remediation

Users can upgrade to OZI GitHub Action version 1.13.6, where this vulnerability has been patched. Alternatively, users can downgrade to a version prior to 1.13.2.