Update lycheeverse/lychee-action action to v2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
lycheeverse/lychee-action	action	major	v1 → v2

GitHub Vulnerability Alerts

CVE-2024-48908

Summary

There is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml.

Details

The GitHub Action variable inputs.lycheeVersion can be used to execute arbitrary code in the context of the action.

PoC

- uses: lycheeverse/lychee@v2
  with:
    lycheeVersion: $(printenv >> $GITHUB_STEP_SUMMARY && echo "v0.16.1")

The previous example will just print all the environment variables to the summary of the workflow, but an attacker could potentially use this vector to compromise the security of the target repository, even passing unnotice because the action will run normally.

Impact

Low

---

Release Notes

lycheeverse/lychee-action (lycheeverse/lychee-action)

v2

Compare Source

---

Configuration

📅 Schedule: (in timezone America/Vancouver)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.