9 matches found
CVE-2026-113357
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
EUVD-2026-104928
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
CVE-2026-113357
The @e2e-dev/github package version before 0.4.1 is vulnerable to an improper authorization vulnerability (CWE-863) that allows for CI report hijacking . The root cause is located in the findComment and upsertComment functions within post.ts, which fail to verify the comment author. Consequently,...
CVE-2026-113357
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
PT-2026-118341
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...
TesterArmy e2e authorization issue vulnerability
Versions of TesterArmy prior to e2e 0.4.1 contain an authorization issue vulnerability. This vulnerability arises because findComment and upsertComment functions in post.ts fail to verify the author of comments; as a result, comment pullers can post comments containing predictable markers, thereb...