CVE-2026-113357
@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
tester-army @e2e-dev/github
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.4.1@e2e-dev/githubCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Text from CVE List
Affected versions 1
- @e2e-dev/githubaffected: all versions before 0.4.1CVE List
References 5
- github.com/tester-army/e2e/pull/1161Fixvia CVE List
- github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fcFixvia CVE List
- github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1Fixvia CVE List
- vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-markerAdvisoryvia CVE List
- github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.tsReferencevia CVE List