LOW 2.2
GHSA-rvp7-w75q-9fv2
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
Details
The `github_workflows` module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
Are you affected?
Enter the version of the package you're using.