CVE-2026-48547CWE-78

KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml

High · published June 11, 2026

CVSS v4.0
8.5
EPSS
1%
Percentile
71.8
In the wild
Unconfirmed
What it is

KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.01375 · 71.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-11T18:33Z
EPSS history
Timeline
  • 11 JUN 18:33Z
    KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml
    cvelistv5