{"id":"CVE-2024-48908","title":"lychee link checking action checks links in Markdown, HTML, and text files using lychee","summary":"lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml.…","severity":"none","cwe":["CWE-94"],"published":"2025-08-28","updated":"2026-09-26","sourceUpdated":"2026-09-26T21:10:00.130","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-48908","references":[{"url":"https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede","label":"security-advisories@github.com"},{"url":"https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00385,"epssPercentile":0.29918,"ingestedAt":"2026-09-26T21:38:01.483Z","slug":"CVE-2024-48908","body":"## Overview\n\nlychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}