A GitHub workflow is using action with HIGH severity CVE

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_355
Category - Subcategory	Pipeline Configuration - 3rd Party Services
Severity	HIGH

Impact

The GitHub workflow which calls a 3rd party action with a HIGH severity CVE introduces a "weakest link" scenario where the build environment—and by extension, the production code—is exposed to exploitation through the automated workflow.