KanaDojo before version 0.1.18 contains an escape from the Node.js sandbox that allows an attacker to execute arbitrary code with the full privileges of the GitHub Actions runner. By submitting a pull request that modifies messages.cjs, a malicious user can import arbitrary Node.js modules, bypass the intended vm.runInNewContext restriction, and run code that can read, modify, or delete repository secrets, including the AUTOMATION_PR_TOKEN used by the workflow.

The product KanaDojo, developed by lingdojo, is affected in all releases earlier than 0.1.18. The vulnerability is triggered when the auto‑respond workflow runs on GitHub Actions for repositories that accept pull requests from external contributors.

The CVSS score of 8.5 highlights the high severity of this flaw. No EPSS score is available and the vulnerability is not listed in CISA KEV catalog. The attack vector requires a crafted pull request that edits messages.cjs; once merged, the malicious code executes inside the GitHub Actions runner with full permissions, enabling the attacker to access any secret or code and to abuse the AUTOMATION_PR_TOKEN with full privileges.