Improper Authorization in @e2e-dev/github Affects CI Test Reports

CVE-2026-113357

What is CVE-2026-113357?

The @e2e-dev/github library before version 0.4.1 contains an improper authorization flaw that permits pull request commenters to manipulate CI test reports. Attackers can leverage this weakness by posting comments with a predictable marker, leading to potential misrepresentation of test results. Specifically, the functions findComment and upsertComment in post.ts do not verify comment authors, allowing malicious users to receive and alter critical test outcomes directly within their comments. This oversight can result in legitimate CI reports being suppressed or deceptive results being presented as genuine.

References