Low severity · published Oct 20, 2026
CVE-2026-113357
@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E2
@e2e-dev/github · tester-army
before 0.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113357
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113357
github.com
https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts
github.com
https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc
github.com
https://github.com/tester-army/e2e/pull/1161
github.com
https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1
www.vulncheck.com
https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker