@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by…
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- GitHub
- Product
- github
- CVSS
- 3.5
Why it ranks 0 (Routine)
- No intrinsic risk signals yet; rank reflects source class and recency only.
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.