CVE-2026-113357

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-113357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-113357
Published
2026-10-20T10:41:41Z
Modified
2026-10-21T02:56:03Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
Details

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113357.json"
}
References

Affected packages

Git / github.com/tester-army/e2e

Affected ranges

Type
GIT
Repo
https://github.com/tester-army/e2e
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a7b13a6cda26b8c10bd16510d9c81149681e3cdb
Fixed
ce4dac373784f87fade6808119ba537a0b4965fc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.4.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "ce4dac373784f87fade6808119ba537a0b4965fc"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@e2e-dev/decision@0.*
@e2e-dev/decision@0.1.0
@e2e-dev/decision@0.2.0
@e2e-dev/decision@0.2.1
@e2e-dev/decision@0.2.2
@e2e-dev/eas@0.*
@e2e-dev/eas@0.1.1
@e2e-dev/eas@0.2.0
@e2e-dev/eas@0.2.1
@e2e-dev/eas@0.3.0
@e2e-dev/eas@0.3.1
@e2e-dev/github@0.*
@e2e-dev/github@0.3.1
@e2e-dev/github@0.3.2
@e2e-dev/github@0.3.3
@e2e-dev/github@0.4.0
@e2e-dev/kernel@0.*
@e2e-dev/kernel@0.1.1
@e2e-dev/kernel@0.1.2
@e2e-dev/kernel@0.2.0
@e2e-dev/kernel@0.2.1
@e2e-dev/limrun@0.*
@e2e-dev/limrun@0.2.0
@e2e-dev/mobile@0.*
@e2e-dev/mobile@0.10.0
@e2e-dev/mobile@0.11.0
@e2e-dev/mobile@0.12.0
@e2e-dev/mobile@0.12.1
@e2e-dev/mobile@0.8.1
@e2e-dev/mobile@0.9.0
@e2e-dev/mobile@0.9.1
@e2e-dev/mobile@0.9.2
@e2e-dev/smol@0.*
@e2e-dev/smol@0.1.0
@e2e-dev/smol@0.1.1
@e2e-dev/web@0.*
@e2e-dev/web@0.11.1
@e2e-dev/web@0.11.2
@e2e-dev/web@0.12.0
@e2e-dev/web@0.13.0
@e2e-dev/web@0.14.0
@e2e-dev/web@0.15.0
e2e@0.*
e2e@0.15.1
e2e@0.15.2
e2e@0.16.0
e2e@0.17.0
e2e@0.18.0
e2e@0.19.0
e2e@0.20.0
e2e@0.21.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113357.json"