Espressif shared-github-dangerjs CVE-2026-44358

Requires the downstream consumer to invoke espressif/shared-github-dangerjs at a version prior to 1.0.1 from a workflow triggered by pull_request_target (or another trigger that checks out fork content into /github/workspace while retaining base-repo secrets), and an attacker able to open a pull request from a fork - which on public repositories is any GitHub user. UI:R is satisfied when the workflow runs on the fork PR, which is automatic for pull_request_target unless gated by environment approvals or branch filters. Exploitation is NOT possible against consumers using the safer pull_request trigger (fork code runs without base secrets), consumers pinned to commit SHA d7424080 or tag 1.0.1+, or repositories that gate the job on head.repo.full_name == github.repository.

CVSS 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) reflects the cross-scope impact: an unauthenticated external attacker (any GitHub user able to open a fork PR) can compromise the integrity of the calling repository, with scope change capturing the leap from the action container into the parent CI/CD trust boundary. UI:R maps to a maintainer or automated workflow triggering CI on the fork PR, which in pull_request_target setups is often automatic. No EPSS, KEV, or SSVC data was supplied and no public exploit identified at time of analysis, but the fix commit publicly documents the exact hijack primitive (CWD-based npx resolution and stray node_modules), which substantially lowers the bar for weaponization against any downstream Espressif repository still on 1.0.0. Real priority is high for organizations that consumed this action via a floating major tag and use pull_request_target; lower for repos pinned to commit SHAs or using only pull_request.

An attacker forks a repository that consumes espressif/shared-github-dangerjs in a pull_request_target workflow, commits a malicious node_modules/.bin/danger (or a node_modules tree shadowing a module the action loads) to their fork, and opens a pull request. When the base repo's workflow runs, entrypoint.sh's npx danger resolves to the attacker's binary inside /github/workspace, executing arbitrary code with the workflow's GITHUB_TOKEN and any configured secrets, enabling secret exfiltration or pushes to the base repository.