High severity · published May 28, 2026
CVE-2026-44358
Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint
8.2
CVSS
0.2%
EPSS
No
On KEV
Description
Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
shared-github-dangerjs · espressif
< 1.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44358
github.com
https://github.com/espressif/shared-github-dangerjs/commit/d742408028135ea200982b5b2e3e438dc4e5a25d
github.com
https://github.com/espressif/shared-github-dangerjs/security/advisories/GHSA-wm3p-pv54-6w73