{"id":"CVE-2025-54594","summary":"react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration","details":"react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pull_request_target event trigger, which allowed for untrusted code from a forked pull request to be executed in a privileged context. An attacker could create a pull request containing a malicious preinstall script in the package.json file and then trigger the vulnerable workflow by posting a specific comment (!canary). This allowed for arbitrary code execution, leading to the exfiltration of sensitive secrets such as GITHUB_TOKEN and NPM_TOKEN, and could have allowed an attacker to push malicious code to the repository or publish compromised packages to the NPM registry. There is a remediation commit which removes github/workflows/release-canary.yml, but a version with this fix has yet to be released.","aliases":["GHSA-588g-38p4-gr6x"],"modified":"2026-08-12T03:51:47.795513592Z","published":"2025-08-05T23:31:53.399Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-269","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54594.json"},"references":[{"type":"WEB","url":"https://callstack.notion.site/Post-Incident-Security-Measures-GitHub-Actions-Workflow-Vulnerability-2405d027c0f8804ab7f7cdfb43366a31"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54594.json"},{"type":"ADVISORY","url":"https://github.com/callstackincubator/react-native-bottom-tabs/security/advisories/GHSA-588g-38p4-gr6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54594"},{"type":"FIX","url":"https://github.com/callstackincubator/react-native-bottom-tabs/commit/9e1c9c61d742c435ac5e0901b7e0c9249b9fc70c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/callstack/react-native-bottom-tabs","events":[{"introduced":"0"},{"fixed":"9e1c9c61d742c435ac5e0901b7e0c9249b9fc70c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.9.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["react-native-bottom-tabs@0.9.2","@bottom-tabs/react-navigation@0.9.2","@bottom-tabs/expo-template@0.0.13","react-native-bottom-tabs@0.9.1","@bottom-tabs/react-navigation@0.9.1","@bottom-tabs/expo-template@0.0.12","react-native-bottom-tabs@0.9.0","@bottom-tabs/react-navigation@0.9.0","@bottom-tabs/expo-template@0.0.11","react-native-bottom-tabs@0.8.9","@bottom-tabs/react-navigation@0.8.9","@bottom-tabs/expo-template@0.0.10","react-native-bottom-tabs@0.8.8","@bottom-tabs/react-navigation@0.8.8","@bottom-tabs/expo-template@0.0.9","react-native-bottom-tabs@0.8.7","@bottom-tabs/react-navigation@0.8.7","@bottom-tabs/expo-template@0.0.8","react-native-bottom-tabs@0.8.6","@bottom-tabs/react-navigation@0.8.6","@bottom-tabs/expo-template@0.0.7","react-native-bottom-tabs@0.8.5","@bottom-tabs/react-navigation@0.8.5","@bottom-tabs/expo-template@0.0.6","react-native-bottom-tabs@0.8.4","@bottom-tabs/react-navigation@0.8.4","@bottom-tabs/expo-template@0.0.5","react-native-bottom-tabs@0.8.3","@bottom-tabs/react-navigation@0.8.3","@bottom-tabs/expo-template@0.0.4","@bottom-tabs/expo-template@0.0.3","react-native-bottom-tabs@0.8.1","@bottom-tabs/react-navigation@0.8.1","react-native-bottom-tabs@0.8.0","@bottom-tabs/react-navigation@0.8.0","react-native-bottom-tabs@0.7.8","@bottom-tabs/react-navigation@0.7.8","react-native-bottom-tabs@0.7.7","@bottom-tabs/react-navigation@0.7.7","react-native-bottom-tabs@0.7.6","@bottom-tabs/react-navigation@0.7.6","react-native-bottom-tabs@0.7.5","@bottom-tabs/react-navigation@0.7.5","react-native-bottom-tabs@0.7.4","@bottom-tabs/react-navigation@0.7.4","react-native-bottom-tabs@0.7.3","@bottom-tabs/react-navigation@0.7.3","react-native-bottom-tabs@0.7.2","@bottom-tabs/react-navigation@0.7.2","react-native-bottom-tabs@0.7.1","@bottom-tabs/react-navigation@0.7.1","react-native-bottom-tabs@0.7.0","@bottom-tabs/react-navigation@0.7.0","v0.6.0","v0.5.2","v0.5.1","v0.5.0","v0.4.0","v0.3.2","v0.3.1","v0.3.0","v0.2.1","v0.2.0","v0.1.4","v0.1.3","v0.1.2","v0.1.0","v0.0.13","v0.0.12","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54594.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}