Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55378— JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

Quick assessment

Affected
shriyanss js-recon
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

JS Recon 是一款用于 JavaScript 枚举和静态应用安全测试（SAST）的工具。在 1.2.1-beta.1 至 1.3.1-beta.2 版本中，位于 中的“PR Branch Checker”工作流将 和 分别赋给变量 和 ，并将这些不可信的值直接插入到 shell 命令 中。攻击者（远程用户）在发起 pull request 时，可以通过在分支名或 fork 名中嵌入 shell 元字符，在 GitHub Actions 运行器中执行任意命令，且该工作流使用的 具有 写权限，从而可能进一步影响仓

CVSS 9.3 · Critical

Possible ATT&CK Techniques 1 AI

T1204.001 · Malicious Link

Affected Version Matrix 1

VendorProduct Version RangeStatus
shriyanss js-recon >= 1.2.1-beta.1, < 1.3.1-beta.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55378

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
Source: CVE Program / CVE List V5
Vulnerability Description
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github.head_ref and github.event.pull_request.head.repo.full_name into BRANCH_NAME and SOURCE_REPO and interpolates those untrusted values into a shell gh pr comment command. A remote user who opens a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
shriyanss js-recon >= 1.2.1-beta.1, < 1.3.1-beta.2 -

II. Public POCs for CVE-2026-55378

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55378

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55378 (1)

Vendor Advisories for CVE-2026-55378 (1)

IV. Related Vulnerabilities

Same weakness: CWE-78

V. Comments for CVE-2026-55378

No comments yet

Leave a comment