Description

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T12:17:44.370Z",
  "pubdate": "2026-08-12T12:17:44.370Z",
  "executiveSummary": "A remote code execution vulnerability exists within the archived cloudflare/pages-action repository, specifically residing in the source file located at src/index.ts.\nThe vulnerability is reachable through certain GitHub Actions workflow configurations utilized by consumers integrating the action into their CI/CD pipelines.\nSuccessful exploitation of this flaw allows malicious actors to achieve remote code execution within the context of the workflow runner.\nThis unauthorized execution capability exposes sensitive workflow secrets, including high-privilege credentials such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN.\nAll published versions of cloudflare/pages-action, including deployments utilizing consumers pinned to the v1 moving tag, are affected by this security issue.\nBecause the affected repository has been officially deprecated since 2024, Cloudflare has confirmed that no security patches or updates will be issued.\nTo eliminate risk, organizations must immediately migrate away from the vulnerable action and transition all affected workflows to cloudflare/wrangler-action prior to the final repository removal date on September 18, 2026.",
  "technicalDetails": "The vulnerability originates in the archived cloudflare/pages-action codebase, specifically within the logic implemented in src/index.ts.\nThe root cause stems from insecure handling of inputs or execution logic exposed via specific GitHub Actions workflow configurations, allowing external or untrusted inputs to trigger arbitrary or unintended command execution.\nThe vulnerable component is the JavaScript-based execution flow handled by the action during runtime execution inside GitHub Actions runners.\nAll published versions of the cloudflare/pages-action repository are impacted, including instances where consumers rely on moving tags such as v1.\nExploitation requires the target repository to utilize specific GitHub Actions workflow configurations that interact with the vulnerable code path in src/index.ts.\nThe attack flow initiates when an attacker leverages the unsafe parsing or execution handling within the action via crafted inputs or workflow contexts.\nUpon successful trigger of the vulnerable code path, remote code execution is achieved inside the GitHub Actions runner environment.\nFollowing successful code execution, the post-exploitation impact includes the unauthorized extraction and exposure of sensitive environment variables and workflow secrets.\nSpecifically, secrets injected into the runner environment—such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN—can be exfiltrated by the attacker to gain unauthorized access to associated cloud infrastructure and source control repositories."
}