@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
CVE-2026-113357
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-113357
@e2e-dev/github
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/tester-army/e2e",
"vendor": "tester-army",
"product": "@e2e-dev/github",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.4.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40e2e-dev/github",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-113357
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #42176 · Revision 1
- Added to Heist Feed
- Publisher date