Network UPS Tools (nut) had a security flaw in its GitHub Actions workflow where the script combined execution of code with elevated privileges (via a single-use GITHUB_TOKEN with write permissions) and untrusted inputs from pull request source branches. This mis-structuring allowed a malicious PR from a forked repository to extract the GITHUB_TOKEN during the workflow run. With this token, an attacker could manipulate the Git repository contents, commit checks/statuses, or issue/PR comments within the scope of the token's permissions. The vulnerability corresponds to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The issue was fixed by commits 658b24e and 1aa31d1, which restructured the workflow to prevent token leakage.

An attacker submitting a malicious pull request from a forked repository could extract the GITHUB_TOKEN used by the GitHub Actions workflow. This token had write permissions, enabling the attacker to manipulate repository contents, alter commit statuses, and modify issue or pull request comments during the workflow execution. This could undermine the integrity of the repository and its CI/CD processes. The CVSS score is 8.2 (high severity), reflecting the network attack vector, required user interaction, and potential for high confidentiality and integrity impact.

The vulnerability has been patched by the vendor via commits 658b24e and 1aa31d1, which corrected the GitHub Actions workflow to separate privileged code from untrusted inputs and prevent token leakage. Users should update to the fixed workflow configuration as per these commits. No further action is required if these patches have been applied.