CVE - CVE-2025-32953

CVE-ID
CVE-2025-32953	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU. In version 1.38 and prior, the `makefile-ubuntu.yml` workflow file uses `actions/upload-artifact@v4` to upload the `z80pack-ubuntu` artifact. This artifact is a zip of the current directory, which includes the automatically generated `.git/config` file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in your repository. This issue has been fixed in commit bd95916.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/udo-munk/z80pack/commit/1e06c2fe498ca772002b5c4f6f9e3085061e47da URL:https://github.com/udo-munk/z80pack/commit/1e06c2fe498ca772002b5c4f6f9e3085061e47da MISC:https://github.com/udo-munk/z80pack/commit/836c2e37b54f86bb4bed9e1406b67e52aa52308d URL:https://github.com/udo-munk/z80pack/commit/836c2e37b54f86bb4bed9e1406b67e52aa52308d MISC:https://github.com/udo-munk/z80pack/commit/95535987d690bd20849fbf143f267283f0e2db91 URL:https://github.com/udo-munk/z80pack/commit/95535987d690bd20849fbf143f267283f0e2db91 MISC:https://github.com/udo-munk/z80pack/commit/bd9591615ae7b1e6229aa60a485447441c4a0c15 URL:https://github.com/udo-munk/z80pack/commit/bd9591615ae7b1e6229aa60a485447441c4a0c15 MISC:https://github.com/udo-munk/z80pack/security/advisories/GHSA-gpjj-f76m-9x3q URL:https://github.com/udo-munk/z80pack/security/advisories/GHSA-gpjj-f76m-9x3q
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20250414	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250414)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)