cocos/cocos-engine

GitHub

github.com

www.cocos.com

Releases232

Frequency2 weeks 17 hours

Last Release 6 months ago

Stars9.63K

Cocos simplifies game creation and distribution with Cocos Creator, a free, open-source, cross-platform game engine. Empowering millions of developers to create high-performance, engaging 2D/3D games and instant web entertainment.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2023-26493 ↗	Mar 27, 2023Monday, 27 March 2023, 22:15	8.1 HIGH	—
Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a pull request was opened or updated and contained the user controllable field `(${{ github.head_ref }} – the name of the fork’s branch)`. This would allow an attacker to take over the GitHub Runner and run custom commands (potentially stealing secrets such as GITHUB_TOKEN) and altering the repository. The workflow has since been removed for the repository. There are no actions required of users.