CVE-2026-113357 tester-army CVE debrief

Who should care

Defenders responsible for maintaining and securing GitHub repositories using the @e2e-dev/github package should assess exposure and prioritize updating to version 0.4.1 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the version in use and update to the fixed version to prevent potential hijacking of CI test reports.

Why it matters

Defenders should care about CVE-2026-113357 because it allows attackers to hijack CI test reports in @e2e-dev/github before 0.4.1, potentially leading to inaccurate reporting and security risks. Roles responsible for maintaining and securing GitHub repositories using this package should assess exposure and prioritize updating to version 0.4.1 or later. The vulnerability's impact is limited to the manipulation of CI test reports, and there is no evidence of data theft, outage, or business impact. Remediation priority follows from verifying the version in use and updating to the fixed version.

• Potential hijacking of CI test reports
• Possible suppression of genuine reports
• Edit failures to passes by attackers
• Receiving results in an attacker's comment

Technical summary

The @e2e-dev/github package before version 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with a predictable marker. This vulnerability is caused by the lack of author checks in findComment and upsertComment in post.ts, allowing attackers to receive results in their own comment and edit failures to passes, or suppress genuine reports entirely. Defenders should prioritize verifying the version in use and updating to version 0.4.1 or later to address the improper authorization vulnerability.

Defensive priority

Defenders should prioritize verifying the version of @e2e-dev/github in use and updating to version 0.4.1 or later to address the improper authorization vulnerability.

Recommended defensive actions

• Verify the version of @e2e-dev/github in use and update to version 0.4.1 or later.
• Review CI test reports for potential hijacking.
• Monitor for suspicious activity related to pull request comments.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the improper authorization vulnerability in @e2e-dev/github before 0.4.1, which allows pull request commenters to hijack CI test reports. The vulnerability is caused by the lack of author checks in findComment and upsertComment in post.ts. Evidence is limited to the information provided in the CVE record and source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.