A GitHub workflow is using action with CRITICAL severity CVE

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_344
Category - Subcategory	Pipeline Configuration - 3rd Party Services
Severity	CRITICAL

Impact

The GitHub workflow which calls a 3rd party action with a CRITICAL severity CVE introduces a "weakest link" scenario where the build environment—and by extension, the production code—is exposed to exploitation through the automated workflow.