EUVD-2026-36273
GHSA-mq42-j95v-p3gq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PR submission with low complexity; PR:L for any GitHub account, UI:R for maintainer/workflow trigger, S:C as the sandbox boundary is crossed, high C/I via token theft, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.
Articles & Coverage 2
AnalysisAI
Sandbox escape leading to remote code execution affects KanaDojo (lingdojo/kana-dojo) before version 0.1.18, where the issue-auto-respond.yml GitHub Actions workflow passes the global require function into a Node.js vm.runInNewContext() sandbox. An attacker submitting a pull request that modifies messages.cjs can load arbitrary Node.js modules from within the sandbox and gain code execution on the Actions runner with access to AUTOMATION_PR_TOKEN. No public exploit identified at time of analysis, though the VulnCheck advisory documents the exploitation primitive in detail.
Technical ContextAI
The root cause maps to CWE-693 (Protection Mechanism Failure): Node.js's vm module is explicitly documented as not being a security boundary, and passing the require function into a vm.runInNewContext() context entirely defeats whatever isolation the sandbox was intended to provide. Once require is reachable from sandboxed code, attacker-controlled JavaScript can load child_process, fs, or any other built-in to break out. The affected component is the issue-auto-respond.yml workflow (CPE cpe:2.3:a:lingdojo:kana-dojo) which sources messages.cjs from the PR head - a classic GitHub Actions pwn_request pattern where untrusted PR content is executed in a privileged workflow context that holds repository secrets.
RemediationAI
Vendor-released patch: upgrade to KanaDojo v0.1.18 or later, which applies the fix in commit 31b85a5d7c4b323ddeba3b2dc5e7807558710544 (https://github.com/lingdojo/kana-dojo/commit/31b85a5d7c4b323ddeba3b2dc5e7807558710544). For forks or downstream copies that cannot upgrade immediately, stop passing require into the vm context in issue-auto-respond.yml and refactor messages.cjs so PR-controlled code is not evaluated by a privileged workflow; alternatively, gate the workflow on pull_request_target with an explicit maintainer-approval step or restrict it to runs triggered by trusted authors, accepting the trade-off that contributor-facing automation will be delayed. As a defensive control, scope AUTOMATION_PR_TOKEN to the minimum permissions required and rotate it if exploitation is suspected. Refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/kanadojo-sandbox-escape-rce-via-messages-cjs.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today