Home

Description

KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.

PUBLISHED Reserved 2026-05-21 | Published 2026-06-11 | Updated 2026-06-15 | Assigner VulnCheck




HIGH: 8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

HIGH: 7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Problem types

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
affected

Any version before 0.1.18
affected

Credits

Katriel Moses finder

VulnCheck finder

References

github.com/lingdojo/kana-dojo/releases/tag/v0.1.18 release-notes

github.com/...ommit/31b85a5d7c4b323ddeba3b2dc5e7807558710544 patch

cve.org (CVE-2026-48547)

nvd.nist.gov (CVE-2026-48547)

Download JSON