What’s Vulnerable › Vulnerabilities

CVE-2026-48547: KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-11 · updated 2026-07-14
• Weakness: CWE-78

Description

KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.

Affected products

• lingdojo kana-dojo: before 0.1.18 — fixed in 0.1.18

How to fix

Upgrade to a fixed version: lingdojo kana-dojo 0.1.18. Check the vendor advisory for mitigations.

References

• https://github.com/lingdojo/kana-dojo/commit/31b85a5d7c4b323ddeba3b2dc5e7807558710544
• https://github.com/lingdojo/kana-dojo/releases/tag/v0.1.18

Get alerted when CVE-2026-48547 or the next vulnerability affects your stack