CVE-2025-46820 Details
Description
phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the GitHub API to push malicious code or rewrite release commits in your repository. Any downstream user of the repository may be affected, but the token should only be valid for the duration of the workflow run, limiting the time during which exploitation could occur. Version 4.1.8 fixes the issue.
A vulnerability exists in phpgt Dom versions prior to 4.1.8, where the GITHUB_TOKEN is inadvertently exposed in the workflow run artifact. The issue arises because the ci.yml workflow uploads a zip file of the current directory, which includes the .git/config file containing the GITHUB_TOKEN. This token can be extracted and used with the GitHub API to push malicious code or alter release commits in the repository. Although the token's validity is limited to the workflow run duration, there is a brief window for exploitation.
Users can update to phpgt Dom version 4.1.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 6, 2025CISA-ADP
Assessed May 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/phpgt/Dom/commit/205cddcc82c002dfa48e874494efbf4c49497394 | [email protected] | Source CodeVendor |
| https://github.com/phpgt/Dom/security/advisories/GHSA-cwj7-6v67-2cm4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpgt/Dom | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2025 | New CVE Received | [email protected] |