E2E Dev Github
Monthly
Improper authorization in @e2e-dev/github before 0.4.1 lets anyone who can comment on a pull request hijack the CI test report comment that the reporter manages. Because findComment and upsertComment in packages/github/src/post.ts match a comment purely by the tool's predictable first-line marker and never verify who wrote it, an attacker can pre-seed a marker-bearing comment so results land in their own comment and edit failures into passes, or post a decoy that causes the genuine report to be suppressed. The flaw requires an authenticated, low-privileged GitHub user (PR:L) and that the CI workflow actually runs to update the report (UI:P), and impact is limited to the integrity of report comments - no code execution or secret exposure; no public exploit code was identified at time of analysis, and 0.4.1 fixes the issue by checking the comment author against the token's account.
Improper authorization in @e2e-dev/github before 0.4.1 lets anyone who can comment on a pull request hijack the CI test report comment that the reporter manages. Because findComment and upsertComment in packages/github/src/post.ts match a comment purely by the tool's predictable first-line marker and never verify who wrote it, an attacker can pre-seed a marker-bearing comment so results land in their own comment and edit failures into passes, or post a decoy that causes the genuine report to be suppressed. The flaw requires an authenticated, low-privileged GitHub user (PR:L) and that the CI workflow actually runs to update the report (UI:P), and impact is limited to the integrity of report comments - no code execution or secret exposure; no public exploit code was identified at time of analysis, and 0.4.1 fixes the issue by checking the comment author against the token's account.