---
id: "CVE-2026-113357"
kind: "vulnerability"
aliases: ["CVE-2026-113357"]
title: "@e2e-dev/github: any PR commenter can forge CI test report comments"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "e2e-testing", "github-actions", "npm", "package"]
not_affected_if: ["no-pr-comment-reporting", "version-0.4.1-or-later"]
published_at: "2026-10-20T11:17:20+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113357", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# @e2e-dev/github: any PR commenter can forge CI test report comments

Versions of @e2e-dev/github before 0.4.1 find and update CI report comments without checking who wrote them. A pull request commenter can post a comment with the predictable marker so the tool edits their comment, changing failures to passes or suppressing the real report.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls @e2e-dev/github` and look for any version below `0.4.1`.
- Search the CI workflow and dependencies for `findComment` or `upsertComment` from this package to confirm it posts PR comments.

## Fix

- Upgrade `@e2e-dev/github` to `0.4.1` or later.
- Until upgraded, do not trust the PR comment as the test result; check the CI job status instead.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113357

## From the sources

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_