CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

Medium 5.1 Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-113357?

CVE-2026-113357 is a medium-severity vulnerability in tester-army @e2e-dev/github, published on 20 Oct 2026.

Official description

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

Weakness: CWE-863

Which versions are affected by CVE-2026-113357?

How do I fix CVE-2026-113357?

No fix has been published for CVE-2026-113357 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-113357 being exploited?

There is no known exploitation of CVE-2026-113357 in the wild and no public exploit code.

Sources

Also known as GHSA-h2x8-9c73-2pwh.