CVE-2026-55378: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in shriyanss js-recon
Description
JS Recon versions from 1.2.1-beta.1 up to but not including 1.3.1-beta.2 contain an OS command injection vulnerability in the PR Branch Checker GitHub Actions workflow. This flaw allows a remote attacker who opens a pull request to inject shell commands via specially crafted branch or fork names. The injected commands execute with the workflow's GITHUB_TOKEN permissions, which include write access to pull requests. The vulnerability is fixed starting with version 1.3.1-beta.2.
CVSS v4.0
Score 9.3critical
Affected software
shriyanss
js-recon
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the PR Branch Checker workflow of JS Recon, where untrusted inputs github.head_ref and github.event.pull_request.head.repo.full_name are interpolated directly into a shell command without proper sanitization. This improper neutralization of special elements (CWE-78) enables an attacker controlling a pull request branch or fork name to execute arbitrary shell commands on the GitHub Actions runner. The GITHUB_TOKEN used by the workflow has write permissions on pull requests, increasing the potential impact. The issue is resolved in version 1.3.1-beta.2.
Potential Impact
An attacker who can open a pull request can execute arbitrary commands on the GitHub Actions runner environment with the privileges of the workflow's GITHUB_TOKEN, which has write access to pull requests. This can lead to unauthorized code execution and modification of pull request data within the repository context.
Mitigation Recommendations
Upgrade to version 1.3.1-beta.2 or later, where this vulnerability is fixed. Until then, avoid running the vulnerable workflow or restrict pull request triggers to trusted users. Patch status is not explicitly confirmed beyond the stated fix version; verify with the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T18:57:40.181Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a91e40cacd9273b4942e82d
Added to database: 08/28/2026, 19:39:56 UTC
Last enriched: 09/07/2026, 15:14:28 UTC
Last updated: 10/11/2026, 06:48:17 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.