CVE-2025-61584: serverless-dns GitHub Action RCE Vulnerability

CVE-2025-61584 Overview

CVE-2025-61584 is a command injection vulnerability in serverless-dns, a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through and including 0.1.30 are affected. The pr.yml GitHub Action interpolates untrusted input — specifically github.event.pull_request.head.repo.clone_url and github.head_ref — directly into a runner command. The action uses the pull_request_target trigger, which grants permissive default permissions [CWE-77]. An unauthenticated attacker can exploit this to push arbitrary data to the repository, leading to attacker-controlled code execution by end users running serverless-dns. The issue is fixed in commit c5537dd and expected to be released in 0.1.31.

Critical Impact
An unauthenticated attacker can inject commands into the GitHub Actions runner, push arbitrary content to the repository, and cause downstream code execution in any consumer of serverless-dns.

Affected Products

serverless-dns (RethinkDNS resolver) versions through 0.1.30
Deployments on Cloudflare Workers, Deno Deploy, Fastly, and Fly.io
Any downstream consumer pulling builds from a poisoned repository

Discovery Timeline

2025-09-30 - CVE-2025-61584 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-61584

Vulnerability Analysis

The vulnerability resides in the pr.yml GitHub Actions workflow used by the serverless-dns repository. The workflow runs on the pull_request_target event, which executes in the context of the base repository and inherits write-capable secrets and permissions. The workflow embeds two attacker-controllable expressions, github.event.pull_request.head.repo.clone_url and github.head_ref, directly into a shell command. Because these values originate from a fork or branch the attacker controls, they can contain shell metacharacters that break out of the intended command.

When the runner evaluates the interpolated expression, the attacker-supplied payload executes with the workflow's elevated token. This token can push commits to the upstream repository. Once malicious code is merged into the main branch or build artifacts, every downstream operator deploying serverless-dns executes the attacker's payload during runtime on Cloudflare Workers, Deno Deploy, Fastly, or Fly.io.

Root Cause

The root cause is unsafe template interpolation of untrusted GitHub context variables into a shell command, combined with the use of the pull_request_target trigger. This trigger executes workflows with repository write permissions even for pull requests from forks. The pattern is classified as [CWE-77] Improper Neutralization of Special Elements used in a Command.

Attack Vector

An attacker opens a pull request from a fork whose branch name (head_ref) or clone URL contains shell metacharacters and command payloads. When the pr.yml workflow triggers, the runner expands the malicious expression inline and executes the injected commands with the workflow's GITHUB_TOKEN. The attacker then uses that token to push commits, modify releases, or alter build outputs. Because no authentication or user interaction is required and the attack vector is network-based, exploitation is straightforward for any unauthenticated GitHub user.

No verified public proof-of-concept code is available. Technical details are documented in GitHub Security Advisory GHSA-9g7x-737f-5xpc and the fix in commit c5537dd.

Detection Methods for CVE-2025-61584

Indicators of Compromise

Unexpected commits to the serverless-dns/serverless-dns repository or its forks authored by the GitHub Actions bot outside normal release windows
Pull request branch names or fork clone URLs containing shell metacharacters such as ;, $(, backticks, or &&
Workflow run logs from pr.yml showing unexpected subprocesses or outbound network connections from the runner
Modified release artifacts or container images whose hashes diverge from prior signed builds

Detection Strategies

Audit GitHub Actions run history for pr.yml executions on serverless-dns versions at or below 0.1.30 and inspect logs for anomalous shell output
Compare deployed serverless-dns code against the upstream tagged release to identify unauthorized modifications
Review repository commit history for force pushes or commits authored by automation tokens during pull request events from forks

Monitoring Recommendations

Enable GitHub audit log streaming for workflow runs, token usage, and branch protection changes
Alert on outbound network traffic from GitHub-hosted runners to non-standard destinations during pull_request_target workflows
Monitor deployed Cloudflare Workers, Deno Deploy, Fastly, and Fly.io instances for unexpected DNS resolution behavior or new outbound endpoints

How to Mitigate CVE-2025-61584

Immediate Actions Required

Upgrade serverless-dns to version 0.1.31 or apply the fix from commit c5537dd once released
Rotate any secrets and tokens that were accessible to the pr.yml workflow on affected repositories
Audit recent commits and releases for unauthorized changes and redeploy from a known-good revision

Patch Information

The vulnerability is fixed in commit c5537dd7f203c59f2b86d1e295c2371f3533946a, expected to ship in serverless-dns 0.1.31. Full advisory details are available in GitHub Security Advisory GHSA-9g7x-737f-5xpc.

Workarounds

Disable or remove the pr.yml workflow until the patched release is deployed
Replace the pull_request_target trigger with pull_request to drop write permissions for fork-originated runs
Pass untrusted context values through environment variables instead of inline expression interpolation, for example env: HEAD_REF: ${{ github.head_ref }} and reference "$HEAD_REF" in shell steps
Apply least-privilege permissions: blocks to workflows so the GITHUB_TOKEN cannot push commits

bash

# Configuration example: hardened workflow snippet
permissions:
  contents: read
  pull-requests: read

on:
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      HEAD_REF: ${{ github.head_ref }}
      CLONE_URL: ${{ github.event.pull_request.head.repo.clone_url }}
    steps:
      - name: Safe usage
        run: |
          echo "Processing PR from: \"$HEAD_REF\""
          git ls-remote "$CLONE_URL" || exit 1