CVE-2025-54594

Description

react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pull_request_target event trigger, which allowed for untrusted code from a forked pull request to be executed in a privileged context. An attacker could create a pull request containing a malicious preinstall script in the package.json file and then trigger the vulnerable workflow by posting a specific comment (!canary). This allowed for arbitrary code execution, leading to the exfiltration of sensitive secrets such as GITHUB_TOKEN and NPM_TOKEN, and could have allowed an attacker to push malicious code to the repository or publish compromised packages to the NPM registry. There is a remediation commit which removes github/workflows/release-canary.yml, but a version with this fix has yet to be released.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: CRITICAL
CVSS score: 9.1 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Effective score: 9.1 / 10 CRITICAL source: CNA overview
CWE(s): CWE-269, CWE-94
Reserved: 2025-07-25
Published: 2025-08-06 01:31 UTC
Last updated: 2025-08-06 22:29 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/54xxx/CVE-2025-54594.json
Linked Threat: CVE-2025-54594 — react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-08-06 00:15:30 UTC
NVD last modified: 2026-06-17 09:40:21 UTC
NVD CVSS v3.1: 9.1 / 10 CRITICAL source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability subscore: 3.9 / 10
Impact subscore: 5.2 / 10
EPSS score: 0.0046 (probability of exploitation in next 30 days)
EPSS percentile: 37.65% vs all CVEs — higher = more likely to be exploited, as of 2026-07-26

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-23669
Assigner: GitHub_M
Published: Aug 5, 2025, 11:31:53 PM
Updated: Aug 6, 2025, 8:29:56 PM
EUVD base score (CVSS 3.1): 9.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS: 0.3500
Vendors: callstackincubator
Products: react-native-bottom-tabs (≤ 0.9.2)

ENISA description: react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pull_request_target event trigger, which allowed for untrusted code from a forked pull request to be executed in a privileged context. An attacker could create a pull request containing a malicious preinstall script in the package.json file and then trigger the vulnerable workflow by posting a specific comment (!canary). This allowed for arbitrary code execution, leading to the exfiltration of sensitive secrets such as GITHUB_TOKEN and NPM_TOKEN, and could have allowed an attacker to push malicious code to the repository or publish compromised packages to the NPM registry. There is a remediation commit which removes github/workflows/release-canary.yml, but a version with this fix has yet to be released.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
callstackincubator	react-native-bottom-tabs	`<= 0.9.2` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

MITRE references (3) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://callstack.notion.site/Post-Incident-Security-Measures-GitHub-Actions-Workflow-Vulnerability-2405d027c0f8804ab7f7cdfb43366a31 security-advisories@github.com
https://github.com/callstackincubator/react-native-bottom-tabs/commit/9e1c9c61d742c435ac5e0901b7e0c9249b9fc70c security-advisories@github.com
https://github.com/callstackincubator/react-native-bottom-tabs/security/advisories/GHSA-588g-38p4-gr6x security-advisories@github.com

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`package.json`	no local data	2026-05-18 21:19 UTC
domain	`release-canary.yml`	no local data	2026-05-18 21:19 UTC

Remediations (16)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Star Citizen Alpha 4.8 LIVE - Hotfix Central [Updated 5.21]

web:robertsspaceindustries.com

Hi Everyone! Time again for another Hotfix Central thread to keep you all up to date on things going on outside of the normal patch cycle in SC Alpha 4.8 LIVE! This will be a living document of...

2026-05-22 14:32 UTC
Microsoft Patch Tuesday - November 2025 - Lansweeper

web:www.lansweeper.com

Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday November 2025 summary.

2026-05-22 14:32 UTC
Microsoft Patch Tuesday, September 2025 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited ...

2026-05-22 14:32 UTC
The "ClickFix" Attack: A New Threat to Your Computer's Security

web:it.lbl.gov

A new attack technique, dubbed "ClickFix," has emerged, putting computer users at risk of compromising their own devices. This attack begins with a deceptive message or warning that appears on your screen, claiming that your computer has a problem or needs to be fixed. The message then instructs you to " fix " the issue by copying and pasting code into your computer. However, this code ...

2026-05-22 14:32 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 14:32 UTC
Microsoft December 2025 Patch Tuesday - 56 Vulnerabilities Fixed ...

web:cybersecuritynews.com

Microsoft released its final Patch Tuesday updates of 2025 on December 9, addressing 56 security vulnerabilities across Windows, Office, Exchange Server, and other components.

2026-05-22 14:32 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-05-22 03:20 UTC
Emergency patch issued for Microsoft Office, 365 over hacking threat - MSN

web:www.msn.com

Microsoft suggests the threat is being used in phishing attacks against vulnerable systems since successful exploitation requires local access to the PC.

2026-05-22 03:20 UTC
KB5087054 - Details, Issues, & Feedback - NinjaOne

web:www.ninjaone.com

Overview KB5087054 is a cumulative security and reliability update for the .NET Framework targeting Windows 11 version 24H2 systems. Released on May 12, 2026, this patch addresses critical vulnerabilities affecting both .NET Framework 3.5 and 4.8.1 installations. The update is designed to be deployed as part of standard maintenance routines and is available through multiple distribution ...

2026-05-22 03:20 UTC
CVE-2025-54594 - Critical Vulnerability - TheHackerWire

web:www.thehackerwire.com

How do I fix or mitigate CVE-2025-54594 ? To protect against CVE-2025-54594 , you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-05-22 03:20 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-22 03:20 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-05-22 03:20 UTC
Nvd - Cve-2025-61594

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-22 03:20 UTC
KB5089899 - Description of the security update for SQL Server 2025 CU4 ...

web:support.microsoft.com

Applies To SQL Server 2025 on Windows (all editions), SQL Server 2025 on Linux (all editions) Summary Improvements and fixes included in this update How to obtain and install the update How to obtain or download the latest cumulative update package for Linux More information File information Information about protection and security Summary This security update contains fixes and resolves ...

2026-05-22 03:20 UTC
Microsoft confirms patching issues in restricted Windows networks

web:www.bleepingcomputer.com

Microsoft says customers in restricted network environments may encounter Windows Update failures after installing the January 2026 optional non-security preview updates.

2026-05-22 03:20 UTC
A guide to vulnerability remediation vs mitigation | @Bugcrowd

web:www.bugcrowd.com

Vulnerability mitigation is typically considered a temporary or interim solution. While mitigation measures can reduce the immediate risk associated with vulnerabilities, they may not provide a permanent fix . Organizations should aim to prioritize and plan for complete vulnerability remediation whenever feasible and allocate resources accordingly.

2026-05-22 03:20 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-54594.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54594",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-06T16:14:28.420227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-06T20:29:56.111Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "react-native-bottom-tabs",
          "vendor": "callstackincubator",
          "versions": [
            {
              "status": "affected",
              "version": "<= 0.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pull_request_target event trigger, which allowed for untrusted code from a forked pull request to be executed in a privileged context. An attacker could create a pull request containing a malicious preinstall script in the package.json file and then trigger the vulnerable workflow by posting a specific comment (!canary). This allowed for arbitrary code execution, leading to the exfiltration of sensitive secrets such as GITHUB_TOKEN and NPM_TOKEN, and could have allowed an attacker to push malicious code to the repository or publish compromised packages to the NPM registry. There is a remediation commit which removes github/workflows/release-canary.yml, but a version with this fix has yet to be released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-05T23:31:53.399Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/callstackincubator/react-native-bottom-tabs/security/advisories/GHSA-588g-38p4-gr6x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/callstackincubator/react-native-bottom-tabs/security/advisories/GHSA-588g-38p4-gr6x"
        },
        {
          "name": "https://github.com/callstackincubator/react-native-bottom-tabs/commit/9e1c9c61d742c435ac5e0901b7e0c9249b9fc70c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/callstackincubator/react-native-bottom-tabs/commit/9e1c9c61d742c435ac5e0901b7e0c9249b9fc70c"
        },
        {
          "name": "https://callstack.notion.site/Post-Incident-Security-Measures-GitHub-Actions-Workflow-Vulnerability-2405d027c0f8804ab7f7cdfb43366a31",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://callstack.notion.site/Post-Incident-Security-Measures-GitHub-Actions-Workflow-Vulnerability-2405d027c0f8804ab7f7cdfb43366a31"
        }
      ],
      "source": {
        "advisory": "GHSA-588g-38p4-gr6x",
        "discovery": "UNKNOWN"
      },
      "title": "react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54594",
    "datePublished": "2025-08-05T23:31:53.399Z",
    "dateReserved": "2025-07-25T16:19:16.095Z",
    "dateUpdated": "2025-08-06T20:29:56.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}