CVE-2026-113357

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

CVSS 4.0

5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)

CWE

CWE-863

Published

2026-10-20

Modified

2026-10-20

Record from

the NVD, synced 2026-10-21

References

• https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts
• https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc
• https://github.com/tester-army/e2e/pull/1161
• https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1
• https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker

Check your stackJSON