Which versions of JS Recon are affected by CVE-2026-55378?

JS Recon (versions 1.2.1-beta.1 through 1.3.1-beta.2) is vulnerable to command injection that permits arbitrary code execution on your CI/CD pipeline via pull request from external attackers.. A patch is available.

How to fix or mitigate CVE-2026-55378?

Within 24 hours, immediately disable or restrict the vulnerable PR Branch Checker workflow (.github/workflows/pr_checker.yml) and review recent pull request activity and workflow execution logs for indicators of exploitation. Within 7 days, perform a security assessment of any code or artifacts produced by GitHub Actions during the vulnerability window, rotate all GitHub Actions secrets and tokens, and validate your current build integrity. Within 30 days, monitor the JS Recon project for security updates; once a patch is released for a version after 1.3.1-beta.2, upgrade immediately and re-review the workflow code before restoring functionality.

JS Recon CVE-2026-55378

Q: What is the CVSS score of CVE-2026-55378?

CVE-2026-55378 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-67859 CRITICAL

OS Command Injection (CWE-78)

2026-08-28 GitHub_M

Command Injection Js Recon Shriyanss

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Any outsider opening a PR triggers it with no auth or interaction (AV:N/AC:L/PR:N/UI:N); runner code execution with a write-scoped token yields high confidentiality/integrity but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 28, 2026 - 21:17 EUVD

Source Code Evidence Fetched

Aug 28, 2026 - 20:15 vuln.today

Analysis Generated

Aug 28, 2026 - 20:15 vuln.today

CVE Published

Aug 28, 2026 - 18:15 cve.org

CRITICAL 9.3

DescriptionCVE.org

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github.head_ref and github.event.pull_request.head.repo.full_name into BRANCH_NAME and SOURCE_REPO and interpolates those untrusted values into a shell gh pr comment command. A remote user who opens a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.

AnalysisAI

Command injection in JS Recon (js-recon) versions 1.2.1-beta.1 through 1.3.1-beta.2 lets anyone who opens a pull request run arbitrary commands on the project's GitHub Actions runner. The vulnerable PR Branch Checker workflow (.github/workflows/pr_checker.yml) interpolates the attacker-controlled branch name and fork repository name into a shell 'gh pr comment' command without sanitization. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the vulnerable pr_checker.yml PR Branch Checker workflow be present and enabled (versions 1.2.1-beta.1 through pre-1.3.1-beta.2) and that the repository accepts pull requests from external forks - the default for a public project. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals point to a genuine, high-priority CI/CD supply-chain risk rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: 1.3.1-beta.2 - upgrade the workflow to this release (commit 447876c), which removes the interpolation by dropping the BRANCH_NAME and SOURCE_REPO environment variables and hardcoding a static comment body that no longer echoes the source repo or branch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, immediately disable or restrict the vulnerable PR Branch Checker workflow (.github/workflows/pr_checker.yml) and review recent pull request activity and workflow execution logs for indicators of exploitation. …

Threat intelligence, references, and detailed analysis are available after sign-in.