What is CVE-2021-21423?

CVE-2021-21423 is a high-severity security vulnerability in projen (npm), affecting versions >= 0.6.0, < 0.16.41. It is fixed in 0.16.41.

How severe is CVE-2021-21423?

CVE-2021-21423 has a CVSS score of 6.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of projen are affected by CVE-2021-21423?

projen (npm) versions >= 0.6.0, < 0.16.41 is affected.

Is there a fix for CVE-2021-21423?

Yes. CVE-2021-21423 is fixed in 0.16.41. Upgrade to this version or later.

Is CVE-2021-21423 exploitable, and should I be worried?

Whether CVE-2021-21423 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2021-21423 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2021-21423?

Upgrade: projen to 0.16.41 or later, projen to 0.16.41 or later.

CVE-2021-21423 in projen

Q: How severe is CVE-2021-21423?

CVE-2021-21423 has a CVSS score of 6.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of projen are affected by CVE-2021-21423?

projen (npm) versions >= 0.6.0, < 0.16.41 is affected.

Q: Is there a fix for CVE-2021-21423?

Yes. CVE-2021-21423 is fixed in 0.16.41. Upgrade to this version or later.

Q: Is CVE-2021-21423 exploitable, and should I be worried?

Whether CVE-2021-21423 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2021-21423 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2021-21423?

Upgrade: projen to 0.16.41 or later, projen to 0.16.41 or later.

Summary

Rebuild-bot workflow may allow unauthorised repository modifications

Workarounds

The recommended way to address the vulnerability is to upgrade projen. Users who cannot upgrade projen may also remove the .github/workflows/rebuild-bot.yml file and add it to their .gitignore file (via projenrc.js) to mitigate the issue.

References

The rebuild-bot.yml workflow managed by projen is only one occurrence of a GitHub Workflows mis-configuration, but it may also be present in other workflows not managed by projen (either hand-written, or managed by other tools). For more information on this class of issues, the Keeping your GitHub Actions and workflows secure: Preventing pwn requests article provides a great overview of the problem.

Impact

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type (including any project type derived from it) include a .github/workflows/rebuild-bot.yml workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository.

The rebuild-bot workflow is triggered by comments including @projen rebuild on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an issue_comment event, and thus always executes with a GITHUB_TOKEN belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by pull_request events, which always execute with a GITHUB_TOKEN belonging to the repository from which the pull-request is made).

Repositories that do not have branch protection configured on their default branch (typically main or master) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed GITHUB_TOKEN would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch.

CVE-2021-21423 has a CVSS score of 6.8 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.16.41); upgrading removes the vulnerable code path.

Affected versions

projen (>= 0.6.0, < 0.16.41) projen (>= 0, < 0.16.41)

Security releases

projen → 0.16.41 (npm) projen → 0.16.41 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

The issue was mitigated in version 0.16.41 of the projen tool, which removes the issue_comment trigger from this workflow. Version 0.17.0 of projen completely removes the rebuild-bot.yml workflow.

Frequently Asked Questions

What is CVE-2021-21423? CVE-2021-21423 is a high-severity security vulnerability in projen (npm), affecting versions >= 0.6.0, < 0.16.41. It is fixed in 0.16.41.
How severe is CVE-2021-21423? CVE-2021-21423 has a CVSS score of 6.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of projen are affected by CVE-2021-21423? projen (npm) versions >= 0.6.0, < 0.16.41 is affected.
Is there a fix for CVE-2021-21423? Yes. CVE-2021-21423 is fixed in 0.16.41. Upgrade to this version or later.
Is CVE-2021-21423 exploitable, and should I be worried? Whether CVE-2021-21423 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2021-21423 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2021-21423?
- Upgrade projen to 0.16.41 or later
- Upgrade projen to 0.16.41 or later