CVE-2026-113357
@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 20, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 20, 2026
Description
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
@e2e-dev/githubtester-army |
|
References
- https://github.com/tester-army/e2e/pull/1161patchissue-tracking
- https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fcpatch
- @e2e-dev/github %40e2e-dev%2Fgithub%400.4.1 Release Notesrelease-notes
- https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.tstechnical-description
- VulnCheck Advisory: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Markerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.