### [CVE-2024-45798](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45798)
![](https://img.shields.io/static/v1?label=Product&message=arduino-esp32&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Commits%20prior%20to%20a7cec020df8f1a815bd8dfd2559f51a2216bcf1c%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=esp32%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=esp32-c3%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=esp32-c6%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=esp32-h2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=esp32-s2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=esp32-s3%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)

### Description

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` workflow (`GHSL-2024-169`) and environment Variable injection (`GHSL-2024-170`). These issue have been addressed but users are advised to verify the contents of the downloaded artifacts.

### POC

#### Reference
- https://github.com/espressif/arduino-esp32/security/advisories/GHSA-h52q-xhg2-6jw8

#### Github
No PoCs found on GitHub currently.