CVE-2026-113357: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A pull request commenter can exploit it by posting a comment containing the predictable CI report marker. The vulnerable code does not verify that the matched comment was authored by the CI integration.
How can I determine whether my CI integration is affected?
Check whether your workflow uses npm/@e2e-dev/github at a version earlier than 0.4.1. Affected behavior may be visible as CI results appearing in an unexpected commenter’s comment, altered failure results, or missing genuine reports.
What should I do if I cannot immediately upgrade?
Restrict who can comment on pull requests where possible, and manually review comments containing the CI report marker and published CI results. Upgrade npm/@e2e-dev/github to 0.4.1 or later when available in your deployment process.