Executive brief
KanaDojo, a language learning application, contains a security flaw in its automated release process. An attacker with the ability to submit pull requests can execute malicious commands during the software build process by submitting specially crafted data in a configuration file. If the malicious request is merged, it could allow the attacker to compromise the build environment, modify the application's source code, or steal sensitive authentication tokens used for project management.
Technical details
A command injection vulnerability exists in the 'release.yml' workflow of KanaDojo due to improper sanitization of input from 'patchNotesData.json'. Specifically, the 'version' and 'changes' fields from this JSON file are interpolated directly into a 'child_process.execSync()' call. An attacker with pull request access can insert shell metacharacters into these fields; if the pull request is merged, the malicious commands execute within the GitHub Actions runner. This environment typically has 'contents: write' permissions and access to the 'GITHUB_TOKEN', potentially allowing for repository takeover or supply chain compromise. The issue is addressed in version 0.1.18.
Affected products
- lingdojo KanaDojo before v0.1.18
Timeline
- 2026-06-11: disclosed
- 2026-06-11: advisory
- 2026-05-27: patched: Release v0.1.18 published