CVE-2026-113357: Incorrect Authorization in tester-army @e2e-dev/github
Description
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
CVSS v4.0
Score 5.1medium
Affected software
tester-army
@e2e-dev/github
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113357 is an improper authorization vulnerability in the @e2e-dev/github package before version 0.4.1. The vulnerability arises because the functions findComment and upsertComment in post.ts do not verify the author of comments. This allows an attacker who can comment on pull requests to hijack continuous integration (CI) test reports by posting comments containing a predictable marker. Consequently, attackers can receive test results in their own comments, alter failure statuses to passes, or suppress legitimate test reports entirely.
Potential Impact
An attacker with the ability to comment on pull requests can manipulate CI test reports by hijacking comments. This can lead to false test results being displayed, such as changing failed tests to passed or suppressing genuine reports, potentially undermining the integrity of the CI process and misleading developers about code quality.
Mitigation Recommendations
Upgrade to version 0.4.1 or later of @e2e-dev/github, where this improper authorization vulnerability has been fixed. No other mitigation steps are indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T01:07:47.767Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad747292cdf04f65620accb
Added to database: 10/20/2026, 10:49:13 UTC
Last enriched: 10/20/2026, 11:03:24 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.