MEDIUM 5.1 NVD
CVE-2026-113357
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
References
- https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/
- https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc
- https://github.com/tester-army/e2e/pull/1161
- https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1
- https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-p
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-10-20 via NVD.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.