CVE-2024-48908: Lycheeverse Lychee-Action

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.

Affected products

• Lycheeverse Lychee-Action: before 2.0.2 (fixed in 2.0.2)

Published 2025-08-28. Last modified 2026-09-26.