CVE-2026-48546 is a sandbox escape vulnerability in lingdojo's kana-dojo product prior to version 0.1.18. The vulnerability arises from the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context within the issue-auto-respond.yml GitHub Actions workflow. An attacker can submit a pull request that modifies the messages.cjs file to import arbitrary Node.js modules, thereby bypassing sandbox restrictions. This enables remote code execution with full privileges of the GitHub Actions runner, including access to sensitive tokens such as AUTOMATION_PR_TOKEN.

Successful exploitation allows an attacker to execute arbitrary code remotely within the GitHub Actions runner environment with elevated privileges. This includes access to sensitive automation tokens (AUTOMATION_PR_TOKEN), potentially leading to unauthorized actions within the repository or broader GitHub environment. The vulnerability compromises the sandbox isolation intended to restrict code execution, resulting in a high-severity security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions (<0.1.18) of kana-dojo in environments where untrusted pull requests can trigger the vulnerable workflow. Restrict GitHub Actions workflows to trusted contributors and consider disabling or restricting the issue-auto-respond.yml workflow to prevent exploitation.