CVE-2025-54594: react-native-bottom-tabs RCE Vulnerability

CVE-2025-54594 Overview

CVE-2025-54594 is a code injection vulnerability in react-native-bottom-tabs, a Native Bottom Tabs library for React Native. The vulnerability exists in the github/workflows/release-canary.yml GitHub Actions workflow, which improperly uses the pull_request_target event trigger. This misconfiguration allows untrusted code from forked pull requests to execute in a privileged context, enabling attackers to exfiltrate sensitive secrets and potentially compromise the software supply chain.

Critical Impact
Attackers can execute arbitrary code to steal GITHUB_TOKEN and NPM_TOKEN secrets, potentially pushing malicious code to the repository or publishing compromised packages to the NPM registry.

Affected Products

react-native-bottom-tabs versions 0.9.2 and below
GitHub repositories using the vulnerable release-canary.yml workflow

Discovery Timeline

2025-08-06 - CVE-2025-54594 published to NVD
2025-08-06 - Last updated in NVD database

Technical Details for CVE-2025-54594

Vulnerability Analysis

This vulnerability represents a critical supply chain security flaw stemming from insecure GitHub Actions workflow configuration. The release-canary.yml workflow improperly implements the pull_request_target event trigger, which executes workflow code in the context of the base repository rather than the fork. This design pattern is inherently dangerous when combined with checkout of pull request code, as it grants forked code access to repository secrets.

The attack leverages the workflow's trust in pull request content. When a malicious actor creates a fork and submits a pull request containing a crafted preinstall script in package.json, they can trigger arbitrary code execution by posting a specific comment (!canary) on their pull request. The workflow then executes in a privileged context with full access to repository secrets.

Root Cause

The root cause is the improper use of the pull_request_target event trigger in combination with checking out and executing code from untrusted pull requests. The pull_request_target event runs in the context of the base repository with access to secrets, but the workflow was configured to check out code from the pull request head, allowing arbitrary code injection through the package.json preinstall script.

Attack Vector

The attack vector is network-based and requires no prior authentication to the target repository. An attacker exploits this vulnerability through the following sequence:

Fork the vulnerable repository
Modify package.json to include a malicious preinstall script
Create a pull request targeting the upstream repository
Post the trigger comment (!canary) on the pull request
The workflow executes with repository secrets, running the malicious preinstall script
Exfiltrate GITHUB_TOKEN and NPM_TOKEN to an attacker-controlled server

The vulnerability mechanism centers on the pull_request_target trigger combined with pull request code checkout. When the !canary comment is posted, the workflow runs with full secret access while executing untrusted code from the fork. The malicious preinstall script in package.json executes during npm install operations, allowing arbitrary command execution with access to environment variables containing sensitive tokens. For complete technical details, see the GitHub Security Advisory GHSA-588g.

Detection Methods for CVE-2025-54594

Indicators of Compromise

Unexpected pull requests from external forks containing modified package.json files with preinstall scripts
Comments containing !canary trigger text on pull requests from untrusted sources
Unusual GitHub Actions workflow runs triggered by pull_request_target events
Unexpected outbound network connections from GitHub Actions runners
Evidence of token exfiltration attempts in workflow logs

Detection Strategies

Audit GitHub Actions workflows for dangerous pull_request_target usage patterns
Monitor for pull requests modifying package.json scripts from external contributors
Review GitHub Actions audit logs for workflow runs triggered by comment events
Implement secret scanning to detect leaked GITHUB_TOKEN or NPM_TOKEN values
Set up alerts for unexpected npm package publications

Monitoring Recommendations

Enable GitHub Advanced Security to detect secret exposure in logs
Configure branch protection rules requiring approval before workflows run on external pull requests
Monitor NPM registry for unauthorized package versions
Implement webhook monitoring for suspicious pull request activity
Review repository access logs for signs of unauthorized token usage

How to Mitigate CVE-2025-54594

Immediate Actions Required

Remove or disable the github/workflows/release-canary.yml workflow immediately
Rotate all potentially exposed secrets including GITHUB_TOKEN and NPM_TOKEN
Audit recent NPM package publications for signs of compromise
Review repository commit history for unauthorized changes
Enable GitHub's required reviews for workflow runs from fork PRs

Patch Information

A remediation commit has been published that removes the vulnerable github/workflows/release-canary.yml workflow. However, a version release containing this fix has not yet been published. Organizations should apply the fix by referencing the remediation commit directly or by manually removing the vulnerable workflow file from their repository.

For detailed post-incident security measures, refer to the Callstack Post-Incident Measures documentation.

Workarounds

Delete the github/workflows/release-canary.yml file from the repository
If canary releases are required, refactor the workflow to use workflow_dispatch instead of pull_request_target
Never checkout pull request code in pull_request_target workflows that have access to secrets
Implement strict workflow approval requirements for external contributors
Use GitHub's environment protection rules to require manual approval before accessing secrets

bash

# Remove the vulnerable workflow file
rm -f .github/workflows/release-canary.yml
git add .github/workflows/release-canary.yml
git commit -m "Security: Remove vulnerable release-canary workflow (CVE-2025-54594)"
git push origin main