The vulnerability resides in Cloudflare’s archived cloudflare/pages-action repository. A flaw in src/index.ts allows a malicious actor to execute arbitrary code when the action is invoked in a GitHub Actions workflow. Successful exploitation can expose sensitive workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN, effectively granting the attacker access to Cloudflare accounts and potentially broader systems. The issue is identified as a remote code execution problem combined with secret exposure, corresponding to the listed CWE weaknesses: CWE-1104 for exposed secrets and CWE-78 for command injection.

All versions of the cloudflare/pages-action GitHub Action are affected, including every release and any workflow that pins to the v1 moving tag. This includes any project using the action in its CI configuration, regardless of the hosted repository or deployment target, as the action code is executed within the workflow runner environment.

The CVSS score of 8.8 classifies this flaw as a high severity vulnerability. No EPSS value is available, so the probability of exploitation cannot be quantified here, but the lack of a patch and the permission model of GitHub Actions suggest a realistic attack opportunity. The vulnerability is not listed in CISA’s KEV catalogue. Because the action repository is deprecated and will be removed on 2026‑09‑18, the only viable mitigation is to move to the actively maintained cloudflare/wrangler-action prior to that date; failure to do so will result in CI disruption and continued exposure to the flaw.