CVE-2026-113357 Details
Description
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
An improper authorization vulnerability has been identified in the @e2e-dev/github package, affecting versions prior to 0.4.1. This vulnerability allows pull request commenters to hijack continuous integration (CI) test reports by posting comments with a predictable marker. The issue arises because the functions findComment and upsertComment in post.ts do not verify the comment author. As a result, attackers can manipulate test results by altering failure reports to indicate passes or by suppressing genuine reports altogether.
Users can update to @e2e-dev/github version 0.4.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @e2e-dev/github | >= 0, < 0.4.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |