Detections
Analytics
SCA: security update for text-generation (GHSA-qq99-p57r-g3v7)
medium Tenable Cloud Security Plugin ID 418270
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A code injection vulnerability exists in the huggingface/text-generation-inference repository,
specifically within the `autodocs.yml` workflow file. The vulnerability arises from the insecure handling
of the `github.head_ref` user input, which is used to dynamically construct a command for installing a
software package. An attacker can exploit this by forking the repository, creating a branch with a
malicious payload as the name, and then opening a pull request to the base repository. Successful
exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner. This
issue affects versions up to and including v2.0.0 and was fixed in version 2.0.0. (CVE-2024-3924)
See Also
Plugin Details
Severity: Medium
ID: 418270
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.07
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Low
Base Score: 3.6
Temporal Score: 2.7
Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2024-3924
CVSS v3
Risk Factor: Medium
Base Score: 4.4
Temporal Score: 3.9
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/2/2024
Vulnerability Publication Date: 5/30/2024
Reference Information
CVE: CVE-2024-3924
cwe: CWE-94