{"id":"CVE-2026-113357","kind":"vulnerability","aliases":["CVE-2026-113357"],"related":[],"title":"@e2e-dev/github: any PR commenter can forge CI test report comments","description":"@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.","summary":"Versions of @e2e-dev/github before 0.4.1 find and update CI report comments without checking who wrote them. A pull request commenter can post a comment with the predictable marker so the tool edits their comment, changing failures to passes or suppressing the real report.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","e2e-testing","github-actions","npm","package"],"not_affected_if":["no-pr-comment-reporting","version-0.4.1-or-later"],"how_to_check":"- Check the installed version with `npm ls @e2e-dev/github` and look for any version below `0.4.1`.\n- Search the CI workflow and dependencies for `findComment` or `upsertComment` from this package to confirm it posts PR comments.","fix":"- Upgrade `@e2e-dev/github` to `0.4.1` or later.\n- Until upgraded, do not trust the PR comment as the test result; check the CI job status instead.","status":"open","published_at":"2026-10-20T11:17:20+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:29:03+00:00","updated_at":"2026-10-25T04:29:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:29:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@e2e-dev/github` to `0.4.1` or later.\n- Until upgraded, do not trust the PR comment as the test result; check the CI job status instead.","reach":"internet","title":"@e2e-dev/github: any PR commenter can forge CI test report comments","impact":"low","summary":"Versions of @e2e-dev/github before 0.4.1 find and update CI report comments without checking who wrote them. A pull request commenter can post a comment with the predictable marker so the tool edits their comment, changing failures to passes or suppressing the real report.","category":"package","nicknames":[],"who_cares":["github-actions","ci","npm","e2e-testing"],"confidence":0.7,"needs_auth":"no","worst_case":"Test results shown on pull requests can be forged or hidden","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @e2e-dev/github` and look for any version below `0.4.1`.\n- Search the CI workflow and dependencies for `findComment` or `upsertComment` from this package to confirm it posts PR comments.","needs_analyst":false,"not_affected_if":["no-pr-comment-reporting","version-0.4.1-or-later"],"who_is_affected":"Teams that use @e2e-dev/github in CI to post test results as pull request comments, especially on repositories that accept comments or pull requests from outside contributors. Repositories that do not use this package, or that only read job status and never rely on the comment, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000608,"input_tokens":3339,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113357':16A,19A '-2026':15A,18A '/github':4A,34B,78C '0.4.1':36B,80C 'action':26B 'allow':87C 'attack':114C 'author':84C,113C 'chang':66B 'check':44B,110C 'ci':10A,20B,40B,93C 'comment':7A,13A,42B,51B,55B,65B,90C,98C,112C,121C 'contain':81C 'cve':14A,17A 'dev':3A,33B,77C 'e2e':2A,22B,32B,76C 'e2e-dev':1A,31B,75C 'e2e-testing':21B 'edit':63B,123C 'entir':131C 'failur':67B,124C 'find':37B 'findcom':104C 'forg':9A 'genuin':129C 'github':25B 'github-act':24B 'hijack':92C 'improp':83C 'marker':59B,102C 'never':109C 'npm':27B 'packag':28B 'pass':69B,126C 'post':53B,97C 'post.ts':108C 'pr':6A 'predict':58B,101C 'pull':49B,88C 'real':73B 'receiv':116C 'report':12A,41B,74B,95C,130C 'request':50B,89C 'result':117C 'suppress':71B,128C 'test':11A,23B,94C 'tool':62B 'updat':39B 'upsertcom':106C 'version':29B 'vulner':85C 'without':43B 'wrote':46B","nicknames":[],"mitigations":[],"who_affected":"Teams that use @e2e-dev/github in CI to post test results as pull request comments, especially on repositories that accept comments or pull requests from outside contributors. Repositories that do not use this package, or that only read job status and never rely on the comment, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113357","severity":null,"published_at":"2026-10-20T11:17:20+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}