CVE-2021-32724 Found In Your GitHub Actions Workflows: `check-spelling/check-spelling@0.0.17-alpha`

[ziyue-pan]

Hello, we are an research team focusing on open source CI/CD security.
We have detected an action containing CVE imported in your workflow configuration.

CVE Info

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32724
GHSA-g86g-chm8-7r2p

Affected Workflow

https://github.com/devonfw-tutorials/tutorials/blob/main/.github/workflows/spell-check.yml#L12

Solution

Edit the workflow to use check-spelling/check-spelling@0.0.19 or newer version.

[jsoref]

This issue isn't really valid. The workflow has been disabled for 11 months.

Your research needs to be a lot better.

[maybeec]

Thanks anyhow for the hint. @ssarmokadam please take up in our shared spellcheck workflow and clean this up.