Espressif shared-github-dangerjs up to 1.0.0 entrypoint.sh pull_request_target uncontrolled search path

Summaryinfo

A vulnerability identified as problematic has been detected in Espressif shared-github-dangerjs up to 1.0.0. This affects the function pull_request_target of the file entrypoint.sh. This manipulation causes uncontrolled search path. This vulnerability is handled as CVE-2026-44358. It is possible to launch the attack on the local host. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Espressif shared-github-dangerjs up to 1.0.0 and classified as critical. Affected by this vulnerability is the function pull_request_target of the file entrypoint.sh. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-44358 since 05/05/2026. The exploitation appears to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading to version 1.0.1 eliminates this vulnerability. Applying the patch d742408028135ea200982b5b2e3e438dc4e5a25d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32908). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Bug Tracking Software

Vendor

• Espressif

Name

• shared-github-dangerjs

Version

• 1.0

License

• open-source

Website

• Product: https://github.com/espressif/shared-github-dangerjs/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion