CVE-2026-44358 Details
Description
Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.
A vulnerability exists in Espressif Shared GitHub Action DangerJS versions prior to 1.0.1. The issue arises because the action's entrypoint script executes DangerJS from the caller's workspace after transferring the fork's checkout, creating an untrusted search path for binary and Node.js module resolution. This flaw allows fork-supplied code to run inside the action container, potentially leading to arbitrary code execution. The vulnerability is particularly concerning when the action is used in a pull_request_target workflow, as it could allow manipulation of the GITHUB_TOKEN and access to sensitive job-exposed secrets.
Users of Espressif Shared GitHub Action DangerJS should update to version 1.0.1 or later. For those pinned to the floating v1 tag, the update will occur automatically once v1 is moved to 1.0.1. Users pinned to a specific commit SHA or to 1.0.0 must manually update. As an additional precaution, review the workflow permissions block and use the minimum required scopes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-427 | Uncontrolled Search Path Element | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |