{"api_version":"v1","generated_at":"2026-10-07T15:15:00+00:00","product":{"cve_count":4,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-actions-toolkit-19c135bbc60d","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/toolkit","name":"toolkit","next_cursor":null,"observations":[{"affected":"0.5.0","affected_versions_present":true,"cve_id":"CVE-2025-5890","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-5890","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-06-09T18:44:14.680Z","patch_url":"","primary_source":"","published":"2025-06-09T18:31:05.291Z"},{"affected":">= 2.0.0, < 2.1.2","affected_versions_present":true,"cve_id":"CVE-2024-42471","cve_url":"https://cve.blacktree.nl/cve/CVE-2024-42471","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-08-27T21:33:03.045Z","patch_url":"","primary_source":"","published":"2024-09-02T16:13:50.712Z"},{"affected":"<= 1.9.0","affected_versions_present":true,"cve_id":"CVE-2022-35954","cve_url":"https://cve.blacktree.nl/cve/CVE-2022-35954","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-04-23T17:50:43.987Z","patch_url":"https://github.com/actions/toolkit/commit/4beda9cbc00ba6eefe387a937c21087ccb8ee9df","primary_source":"","published":"2022-08-13T23:40:09.000Z"},{"affected":"< 1.2.6","affected_versions_present":true,"cve_id":"CVE-2020-15228","cve_url":"https://cve.blacktree.nl/cve/CVE-2020-15228","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2024-08-04T13:08:22.896Z","patch_url":"","primary_source":"","published":"2020-10-01T17:25:12.000Z"}],"source_generated_at":"2026-10-07T06:21:30.017Z","vendor":"actions"}}