What’s Vulnerable › Vulnerabilities

CVE-2026-113357: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-20
• Weakness: CWE-863

Description

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

Affected products

• tester-army @e2e-dev/github: before 0.4.1 — fixed in 0.4.1

How to fix

Upgrade to a fixed version: tester-army @e2e-dev/github 0.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts
• https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc
• https://github.com/tester-army/e2e/pull/1161
• https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1
• https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker

Get alerted when CVE-2026-113357 or the next vulnerability affects your stack