CVE-2026-44358: Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint
Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pullrequesttarget workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Espressif Shared GitHub DangerJSto a version that resolves this vulnerability.Fixed in 1.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44358?
CVE-2026-44358 has a high severity rating of 8.2.
How do I fix CVE-2026-44358?
To fix CVE-2026-44358, update the Espressif Shared GitHub DangerJS action to version 1.0.1 or later.
What type of vulnerability is CVE-2026-44358?
CVE-2026-44358 is an untrusted search path vulnerability in the DangerJS Action Entrypoint.
Who is affected by CVE-2026-44358?
CVE-2026-44358 affects users of the Espressif Shared GitHub DangerJS prior to version 1.0.1.
What are the potential impacts of CVE-2026-44358?
The potential impacts of CVE-2026-44358 include unauthorized code execution due to the untrusted environment.