Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113357@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

Low 3.5

In plain English

A low-severity incorrect authorization in @e2e-dev/github from tester-army. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 87.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

Affected products (as reported)

Vendor	Product	Versions
tester-army	@e2e-dev/github	0 – before 0.4.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/tester-army/e2e/pull/1161 patch, issue-tracking
https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc patch
@e2e-dev/github %40e2e-dev%2Fgithub%400.4.1 Release Notes release-notes
https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts technical-description
VulnCheck Advisory: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker third-party-advisory