CVE-2025-47775

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-477769.1Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the CVE-2025-477779.65ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerablCVE-2025-477786.1Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, aCVE-2025-477796.5Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18CVE-2025-47788.8A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0. It has been declared as critical. This vulnerability affects uCVE-2025-477807.8Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18CVE-2025-477819.8Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authCVE-2025-477828.9motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0CVE-2025-477836.1Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a mCVE-2025-477849.8Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefuCVE-2025-477858.8Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameCVE-2025-477864.8Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered u