CVE-2026-55378: JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values into a shell gh pr comment command. A remote user who opens a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUBTOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JS Reconto a version that resolves this vulnerability.Fixed in 1.3.1-beta.2
Event History
Frequently Asked Questions
Which JS Recon releases are affected?
Versions from 1.2.1-beta.1 through 1.3.1-beta.2 are affected. The issue is fixed in 1.3.1-beta.2.
What does an attacker need to exploit this issue?
An attacker needs to open a pull request and supply shell metacharacters through the pull request branch name or fork repository name. Exploitation occurs when the PR Branch Checker workflow processes those untrusted values.
What access could command execution obtain in the runner?
Commands execute in the GitHub Actions runner using the workflow's GITHUB_TOKEN. That token has pull-requests write permission.