Digest · Friday
Security digest: July 25, 2025
2 critical advisories.
All digests · RSS · Markdown
Take stock
- npm: 1 critical advisory (
node-saml,@node-saml/node-saml). Check withnpm audit (or: npm ls <package>). - GitHub Actions: 1 critical advisory (
tj-actions/branch-names). Check withgrep -rn 'uses: <owner>/<action>' .github/workflows. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
GitHub Actions 1
Check: grep -rn 'uses: <owner>/<action>' .github/workflows
- tj-actions/branch-names has a Command Injection Vulnerability CVE-2025-54416 CVSS 9.1 Critical
tj-actions/branch-names<= 8.2.1 → fixed in 9.0.0
npm 1
Check: npm audit (or: npm ls <package>)
- Node-SAML SAML Authentication Bypass CVE-2025-54369 CVSS 9.3 Critical
node-saml<= 3.1.2 → no fix listed;@node-saml/node-saml<= 5.0.1 → fixed in 5.1.0