Live › vulnerability › CVE-2026-113357
Go to dashboardVersions of @e2e-dev/github before 0.4.1 find and update CI report comments without checking who wrote them. A pull request commenter can post a comment with the predictable marker so the tool edits their comment, changing failures to passes or suppressing the real report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that use @e2e-dev/github in CI to post test results as pull request comments, especially on repositories that accept comments or pull requests from outside contributors. Repositories that do not use this package, or that only read job status and never rely on the comment, can skip it.
No product ranges from the sources yet.
npm ls @e2e-dev/github and look for any version below 0.4.1.findComment or upsertComment from this package to confirm it posts PR comments.@e2e-dev/github to 0.4.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
This page as .md · .json · in your agent: get_signal("CVE-2026-113357")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.