CVE-2026-113357

LOW 3.5

@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

CWE	CWE-863
Vendor	tester-army
Product	@e2e-dev/github
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for tester-army @e2e-dev/github

Be the first to know when new low vulnerabilities affecting tester-army @e2e-dev/github are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

tester-army / @e2e-dev/github

0 < 0.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tester-army/e2e/pull/1161 github.com: https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc github.com: https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1 github.com: https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts vulncheck.com: https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker

Credits

Brandon Tarr