diff --git a/advisories/github-reviewed/2024/11/GHSA-5xr6-xhww-33m4/GHSA-5xr6-xhww-33m4.json b/advisories/github-reviewed/2024/11/GHSA-5xr6-xhww-33m4/GHSA-5xr6-xhww-33m4.json
new file mode 100644
index 00000000000..926ce450b88
--- /dev/null
+++ b/advisories/github-reviewed/2024/11/GHSA-5xr6-xhww-33m4/GHSA-5xr6-xhww-33m4.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5xr6-xhww-33m4",
+  "modified": "2024-11-25T15:26:43Z",
+  "published": "2024-11-25T15:26:43Z",
+  "aliases": [
+
+  ],
+  "summary": "Artifact poisoning vulnerability in action-download-artifact v5 and earlier",
+  "details": "### Summary\n\nIn versions of `dawidd6/action-download-artifact` before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.\n\nUsers should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set `allow_forks: false` to disable searching forks for artifacts.\n\n### Details\n\nGitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the \"latest\" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream. \n\nBecause any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):\n\n1. Repository `alice/foo` runs `build.yml`, producing `build.exe`\n2. Repository `alice/foo` runs `publish.yml`, which uses `action-download-artifact@v5` to retrieve the latest `build.exe` from `build.yml`\n\nTo compromise `publish.yml` in this scenario, Mallory forks `alice/foo` to `mallory/foo`, and then modifies `build.yml` to produce a compromised `build.exe`. Mallory can then repeatedly trigger their copy of `build.yml` to ensure that their compromised `build.exe` is always the latest artifact, meaning that Alice's `publish.yml` will retrieve it.\n\nAdditional details on this vulnerability can be found in this blog post from 2022:\n\n* https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust\n\n### Impact\n\nThis vulnerability impacts all repositories on GitHub that use `action-download-artifacts@v5` or older and do **not** disable `allow_forks: true`, which is the default.\n\nIf a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as `push` or `pull_request_target`).\n",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "GitHub Actions",
+        "name": "dawidd6/action-download-artifact"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/dawidd6/action-download-artifact/security/advisories/GHSA-5xr6-xhww-33m4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dawidd6/action-download-artifact/commit/bf251b5aa9c2f7eeb574a96ee720e24f801b7c11"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/dawidd6/action-download-artifact"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-349"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-25T15:26:43Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file