The provided Node package (externals/nodeXX) contains the node-ip version <2.0.1 which might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic. (https://nvd.nist.gov/vuln/detail/CVE-2023-42282)

When action-runner is deployed as ECS task this is reported as a finding/vulnerability

Runner Version and Platform

3.15.0 Linux (probably all other platforms as well)