---
title: "GHSA-x6gv-2rvh-qmp6: m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials"
url: https://erroneo.us/security/ghsa/GHSA-x6gv-2rvh-qmp6/
description: "GHSA-x6gv-2rvh-qmp6 (critical, GitHub Actions): m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control…"
type: advisory
section: "Security Digest"
date_published: 2025-08-13
date_modified: 2025-10-27
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-x6gv-2rvh-qmp6"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-x6gv-2rvh-qmp6: m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials

## Affected packages

- GitHub Actions `m00nl1ght-dev/steam-workshop-deploy` < 4 → fixed: 4
- GitHub Actions `BoldestDungeon/steam-workshop-deploy` < 2.0.0 → fixed: 2.0.0

## Details

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory (e.g., due to a local Git repo, custom project structure, or via the actions/checkout workflow), it is silently included in the output package. This results in leakage of sensitive repository metadata and potentially credentials, including github personal access tokens (PATs) embedded in .git/config. Many game modding projects require packaging from the project root as the game expects certain files (assets, configuration, metadata) to be present at specific root-level paths. Consequently, the .git directory often exists alongside these required files and gets packaged unintentionally, especially when using actions/checkout. While github hosted runners automatically revoke ephemeral credentials at the end of each job, the severity of this issue increases dramatically in other CI environments: - Self-hosted runners may store long-lived tokens or secrets. - Developers may maintain their own .git folders with embedded PATs or remotes tied to private repositories. - The workflow may run without the actions/checkout action, distributing the .git directory present on the running machine if it exists in the directory. A real example of an affected mod can be found here: https://github.com/BoldestDungeon/wildermyth-drauven-pcs/security/advisories/GHSA-7j9v-72w9-ww6w Details Who is affected: - Any user of steam-workshop-deploy operating in an environment where .git exists in the packaging directory. - Any user of steam-workshop-deploy operating in an environment where the actions/checkout workflow is used and then the .git directory is inadvertently generated within the packaging directory (greatly reduced severity due to the ephemeral nature of github actions). Impact The severity of this issue for downstream components can range from 0.0 (no credentials, sensitive metadata, or private source code were present in the packaging directory) to 10.0 (extremely sensitive, high privilige credentials or source code from private repositories were exposed). The actual severity depends primarily on the permissions, scope, and nature of the exposed data: Low/none (0.0-3.9):…

## Sources

- [GitHub Advisory GHSA-x6gv-2rvh-qmp6](https://github.com/advisories/GHSA-x6gv-2rvh-qmp6)
- [github.com](https://github.com/BoldestDungeon/steam-workshop-deploy/security/advisories/GHSA-x6gv-2rvh-qmp6)
- [github.com](https://github.com/BoldestDungeon/steam-workshop-deploy/commit/0ba85729da32108e1cc498d1b3d6760857b5c04d)
- [github.com](https://github.com/BoldestDungeon/steam-workshop-deploy/releases/tag/V2.0.0)
- [github.com](https://github.com/m00nl1ght-dev/steam-workshop-deploy/releases/tag/v4)
- [github.com](https://github.com/m00nl1ght-dev/steam-workshop-deploy/commit/913f0844e2153d798189397036918f4ceb0911e0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-x6gv-2rvh-qmp6/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt