CVE-2026-48546 | BDVDB-2026-339796 Detail

Description#

KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-11Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.