Espressif's shared-github-dangerjs GitHub Action versions before 1.0.1 contain an uncontrolled search path element vulnerability (CWE-427) where the entrypoint.sh script runs DangerJS from the caller's workspace after copying the fork's checkout. This creates an untrusted search path for binaries and Node.js modules, enabling fork pull requests processed by pull_request_target workflows to execute arbitrary fork-supplied code within the action container. This vulnerability is addressed in version 1.0.1.

The vulnerability allows an attacker submitting a fork pull request to execute arbitrary code inside the action container by exploiting the untrusted search path for binaries and Node.js modules. This can lead to high integrity impact since malicious code can replace expected binaries or modules. Confidentiality impact is low, and availability is not affected. There are no known exploits in the wild as of the published date.

Upgrade Espressif shared-github-dangerjs to version 1.0.1 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, confirm the upgrade by verifying the version in use. Patch status is not explicitly confirmed beyond the version fix note; check the vendor's repository or advisory for current remediation guidance.