CVE Alert: CVE-2025-54430
Vulnerability Summary: CVE-2025-54430
dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issue_comment can be triggered using the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }}, which correspond to the branch of the PR manipulated by potentially malicious actors, and where untrusted code may be executed. Running untrusted code may lead to the exfiltration of GITHUB_TOKEN, which in this workflow has write permissions on most of the scopes – in particular the contents one – and could lead to potential repository takeover. This is fixed by commit 3f61e79.
Affected Endpoints:
No affected endpoints listed.
Published Date:
7/30/2025, 2:15:29 PM
💀 CVSS Score:
Exploit Status:
Not ExploitedReferences:
- https://github.com/dedupeio/dedupe/commit/3f61e79102910bd355e920a2df7e44c14c9cb247
- https://github.com/dedupeio/dedupe/security/advisories/GHSA-wrg3-xqw8-m85p
Recommended Action:
No proposed action available. Please refer to vendor documentation for updates.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
