CVE-2025-5890 Overview
CVE-2025-5890 is a Regular Expression Denial of Service (ReDoS) vulnerability in the GitHub actions/toolkit package version 0.5.0. The flaw resides in the globEscape function within toolkit/packages/glob/src/internal-pattern.ts. An attacker can supply crafted input that triggers inefficient regular expression evaluation, consuming excessive CPU resources. The issue is classified under [CWE-400: Uncontrolled Resource Consumption]. Exploitation is possible remotely and requires only low privileges with no user interaction.
Critical Impact
Remote attackers can degrade availability of GitHub Actions workflows or downstream consumers by supplying inputs that trigger catastrophic backtracking in the globEscape regex.
Affected Products
- GitHub actions/toolkit glob package version 0.5.0
- CI/CD pipelines depending on the vulnerable @actions/glob module
- GitHub Actions workflows that pass untrusted input to glob pattern processing
Discovery Timeline
- 2025-06-09 - CVE-2025-5890 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5890
Vulnerability Analysis
The vulnerability affects the globEscape function in toolkit/packages/glob/src/internal-pattern.ts. This function escapes special glob metacharacters using a regular expression. The regex pattern exhibits inefficient complexity when processing specific input strings, leading to catastrophic backtracking. Processing large or adversarial inputs causes CPU utilization to spike, blocking the event loop in Node.js runtime environments. Because the GitHub Actions toolkit is widely embedded in CI/CD tooling, the vulnerability can propagate into any workflow that forwards untrusted input to glob operations. Public exploitation has not been observed and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Remediation details are tracked in GitHub Pull Request #2057.
Root Cause
The root cause is inefficient regular expression complexity in the globEscape routine. The pattern permits ambiguous matching states that force the regex engine into exponential backtracking when specific character sequences are supplied. This aligns with [CWE-400: Uncontrolled Resource Consumption].
Attack Vector
The attack vector is network-accessible with low privileges required. An attacker submits crafted strings, such as through workflow inputs, pull request titles, or user-controlled repository data, that reach the globEscape function. The regex engine then consumes excessive CPU time processing the malicious input. See the VulDB entry #311661 for additional technical context.
No verified public exploit code is available. The vulnerability manifests when untrusted strings are passed to the globEscape function, which invokes a regular expression susceptible to catastrophic backtracking. Refer to the linked GitHub pull request for the corrected implementation.
Detection Methods for CVE-2025-5890
Indicators of Compromise
- Sustained CPU spikes in Node.js processes executing GitHub Actions workflows or toolchains built on @actions/glob.
- Workflow jobs timing out or hanging during glob pattern resolution steps.
- Unusually long execution durations for actions that process user-supplied file patterns.
Detection Strategies
- Inventory CI/CD dependencies with software composition analysis to identify @actions/glob version 0.5.0.
- Instrument workflow runners to log per-step CPU and wall-clock time for glob operations.
- Review pull request and workflow input logs for oversized or repetitive character sequences targeting glob inputs.
Monitoring Recommendations
- Alert on runner processes exceeding baseline CPU thresholds during glob-related steps.
- Monitor GitHub Actions job duration outliers and correlate with untrusted input sources.
- Track upstream advisories on the actions/toolkit repository for patched versions.
How to Mitigate CVE-2025-5890
Immediate Actions Required
- Identify all repositories and internal tooling depending on actions/toolkit glob package version 0.5.0.
- Upgrade to a fixed release that incorporates the changes from pull request #2057.
- Restrict or validate untrusted input before it reaches glob pattern functions in custom actions.
Patch Information
The fix is implemented in GitHub Pull Request #2057, which revises the globEscape regular expression to eliminate catastrophic backtracking. Consumers should update the @actions/glob dependency to a version that includes this commit and rebuild affected workflows.
Workarounds
- Apply length limits and character allowlists to any user-controlled input passed to glob functions.
- Wrap glob calls in worker threads or timeout guards to bound CPU consumption per operation.
- Avoid passing pull request titles, branch names, or issue content directly into @actions/glob without sanitization.
# Update the vulnerable dependency in Node.js projects
npm update @actions/glob
npm audit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.