Espressif's shared-github-dangerjs GitHub Action versions before 1.0.1 contain an uncontrolled search path element vulnerability (CWE-427) in the entrypoint.sh script. The script invokes DangerJS from the caller's workspace after copying the fork's checkout, allowing untrusted code from fork pull requests processed by pull_request_target workflows to execute inside the action container. This can lead to execution of malicious code supplied by the fork instead of the action's own code. The vulnerability is addressed in version 1.0.1.

The vulnerability allows an attacker submitting a forked pull request to execute arbitrary code within the GitHub Action container by exploiting the untrusted search path for binaries and Node.js modules. This can lead to high integrity impact by replacing intended code execution with attacker-controlled code. Confidentiality impact is limited, and availability is not affected. There are no known exploits in the wild as of the published date.

Upgrade Espressif shared-github-dangerjs to version 1.0.1 or later, where the vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version in use and update accordingly. Patch status is not explicitly confirmed beyond the version fix noted; check the vendor's repository or release notes for official confirmation and further guidance.