Executive brief
JS Recon is a JavaScript enumeration and security analysis tool distributed via GitHub. An attacker can open a malicious pull request with shell metacharacters in the branch or repository name, causing the tool's automated PR checker workflow to execute arbitrary commands in GitHub Actions with write access to pull requests. This could allow unauthorized modification of pull requests or further compromise of the repository.
Technical details
The vulnerability is a command injection flaw in the GitHub Actions workflow file .github/workflows/pr_checker.yml. The workflow takes untrusted user-controlled input from github.head_ref (branch name) and github.event.pull_request.head.repo.full_name (repository name) and interpolates these values directly into a shell command (gh pr comment) without sanitization. An attacker can craft a pull request with shell metacharacters (e.g., backticks, $(), pipes) in the branch name or fork repository name to break out of the intended command and execute arbitrary shell commands. The injected commands execute in the GitHub Actions runner environment with the workflow's GITHUB_TOKEN, which has pull_request write permissions, allowing the attacker to modify pull requests or perform other privileged actions. No authentication is required beyond the ability to open a pull request. The fix, released in version 1.3.1-beta.2, removes the untrusted variables from the workflow command.
Affected products
- js-recon JS Recon 1.2.1-beta.1 to 1.3.1-beta.1
Timeline
- 2026-08-28: disclosed: CVE-2026-55378 published on NVD
- 2026-06-12: patched: Fixed in version 1.3.1-beta.2 via commit 447876c