Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for @e2e-dev/github by tester-army

    CVE-2026-113357 (GCVE-0-2026-113357)

    Vulnerability from nvd – Published: 2026-10-20 10:41 – Updated: 2026-10-20 13:42
    VLAI
    Title
    @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
    Summary
    @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    3.5 (Low)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-20 13:42 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6545 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    tester-army @e2e-dev/github Affected: 0 , < 0.4.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-15 09:58
    Credits
    Brandon Tarr
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113357",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T13:42:40.490113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T13:42:52.211Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40e2e-dev/github",
          "product": "@e2e-dev/github",
          "repo": "https://github.com/tester-army/e2e",
          "vendor": "tester-army",
          "versions": [
            {
              "lessThan": "0.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brandon Tarr"
        }
      ],
      "datePublic": "2026-10-15T09:58:23.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T10:41:41.607Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/tester-army/e2e/pull/1161"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc"
        },
        {
          "name": "@e2e-dev/github %40e2e-dev%2Fgithub%400.4.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts"
        },
        {
          "name": "VulnCheck Advisory: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker"
        }
      ],
      "title": "@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113357",
    "datePublished": "2026-10-20T10:41:41.607Z",
    "dateReserved": "2026-10-20T01:07:47.767Z",
    "dateUpdated": "2026-10-20T13:42:52.211Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-113357 (GCVE-0-2026-113357)

    Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 13:42
    VLAI
    Title
    @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
    Summary
    @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    3.5 (Low)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-20 13:42 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6545 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    tester-army @e2e-dev/github Affected: 0 , < 0.4.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-15 09:58
    Credits
    Brandon Tarr
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113357",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T13:42:40.490113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T13:42:52.211Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40e2e-dev/github",
          "product": "@e2e-dev/github",
          "repo": "https://github.com/tester-army/e2e",
          "vendor": "tester-army",
          "versions": [
            {
              "lessThan": "0.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brandon Tarr"
        }
      ],
      "datePublic": "2026-10-15T09:58:23.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T10:41:41.607Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/tester-army/e2e/pull/1161"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc"
        },
        {
          "name": "@e2e-dev/github %40e2e-dev%2Fgithub%400.4.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts"
        },
        {
          "name": "VulnCheck Advisory: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker"
        }
      ],
      "title": "@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113357",
    "datePublished": "2026-10-20T10:41:41.607Z",
    "dateReserved": "2026-10-20T01:07:47.767Z",
    "dateUpdated": "2026-10-20T13:42:52.211Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}