PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48546 lingdojo CVE debrief

CVE-2026-48546 is a high-severity vulnerability in KanaDojo, a linguistic tool, which allows attackers to execute arbitrary code. The vulnerability exists due to the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. This enables attackers to submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges, including access to AUTOMATION_PR_TOKEN.

Vendor
lingdojo
Product
kana-dojo
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-07-14
Advisory published
2026-06-11
Advisory updated
2026-07-14

Who should care

Users of KanaDojo before version 0.1.18, GitHub Actions users with AUTOMATION_PR_TOKEN access, and security teams monitoring for potential remote code execution vulnerabilities.

Technical summary

The vulnerability is caused by the insecure use of Node.js vm.runInNewContext() in KanaDojo's issue-auto-respond.yml workflow. This allows an attacker to execute arbitrary code by modifying messages.cjs to import malicious Node.js modules.

Defensive priority

High

Recommended defensive actions

  • Update KanaDojo to version 0.1.18 or later.
  • Review and restrict the use of AUTOMATION_PR_TOKEN in GitHub Actions workflows.
  • Monitor for suspicious pull requests and code modifications in KanaDojo.

Evidence notes

The CVE record and NVD detail provide official information on the vulnerability. Additional sources include the GitHub commit and release notes for the patched version.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48546 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48546

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48546 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48546

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.