Description
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github.head_ref and github.event.pull_request.head.repo.full_name into BRANCH_NAME and SOURCE_REPO and interpolates those untrusted values into a shell gh pr comment command. A remote user who opens a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.
Published: 2026-08-28
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via command injection in GitHub Actions workflow
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows a malicious pull request author to embed shell metacharacters in the pull‑request's branch name or fork name. Those values are interpolated untrusted into a shell command (gh pr comment) executed by the PR Branch Checker workflow. The injected payload runs with the runner's GITHUB_TOKEN, which has pull‑request write permissions, thus enabling arbitrary command execution on the workflow host. The flaw falls under CWE-78: Improper Neutralization of Input During Command Generation.

Affected Systems

The issue affects the "shriyanss:js-recon" repository. Vulnerable releases range from 1.2.1‑beta.1 through 1.3.1‑beta.2 inclusive. All versions under this range that contain the PR Branch Checker workflow are impacted.

Risk and Exploitability

The published CVSS score of 9.3 classifies this exposure as critical. The EPSS score is not available, but given the ability to run arbitrary code with repository write access, the exploitation risk is high. It is not listed in the CISA KEV catalog. Attackers can trigger it by opening a pull request with a crafted branch or fork name, making the threat vector remote and readily achievable on any public or private GitHub repository utilizing the vulnerable workflow.

Generated by OpenCVE AI on August 28, 2026 at 20:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade "js-recon" to version 1.3.1‑beta.2 or newer where the injection source is sanitized.
  • If an immediate upgrade is not feasible, disable or remove the PR Branch Checker workflow until the fix is applied.
  • Consider restricting the permissions of the runner’s GITHUB_TOKEN or replacing it with a token that lacks pull‑request write rights to limit impact of any future injection attempts.

Generated by OpenCVE AI on August 28, 2026 at 20:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Shriyanss
Shriyanss js-recon
Vendors & Products Shriyanss
Shriyanss js-recon

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github.head_ref and github.event.pull_request.head.repo.full_name into BRANCH_NAME and SOURCE_REPO and interpolates those untrusted values into a shell gh pr comment command. A remote user who opens a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.
Title JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Shriyanss Js-recon
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-01T01:51:26.785Z

Reserved: 2026-06-16T18:57:40.181Z

Link: CVE-2026-55378

cve-icon Vulnrichment

Updated: 2026-09-01T01:51:22.651Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:27.200

Modified: 2026-09-09T21:09:13.080

Link: CVE-2026-55378

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T11:20:17Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')