CVE-2026-48546: KanaDojo Sandbox Escape RCE in GitHub Actions Workflow

Technical summary

CVE-2026-48546 is a sandbox escape vulnerability in KanaDojo versions prior to 0.1.18. The issue-auto-respond.yml workflow uses vm.runInNewContext() with the global require function explicitly passed into the sandbox context. This design flaw allows an attacker to submit a pull request that modifies messages.cjs to import arbitrary Node.js modules. By leveraging the exposed require function, the attacker bypasses sandbox restrictions and achieves remote code execution (RCE) with the full privileges of the GitHub Actions runner environment, including access to the AUTOMATION_PR_TOKEN secret.

Business impact

Successful exploitation leads to unauthorized code execution within CI/CD pipeline environments, potentially allowing attackers to exfiltrate secrets, modify repository content, deploy malicious artifacts, or pivot to downstream systems that consume build outputs. Organizations using KanaDojo for automated workflows face risks to supply chain integrity, secret management, and overall repository security. The impact is particularly severe because the attack vector requires only the ability to submit a pull request, a relatively low barrier in open collaboration scenarios.

Affected systems

KanaDojo versions before 0.1.18 are affected. The vulnerability is triggered specifically through the issue-auto-respond.yml workflow when processing pull requests that modify the messages.cjs file. Any environment running KanaDojo with this workflow enabled and accepting external pull requests is at risk.

Exploitability

The attack requires authenticated access to submit a pull request (PR:L in the CVSS vector), making it accessible to collaborators, members of organizations with repository write access, or in public repositories where external contributors can submit PRs. The vulnerability requires no special interaction beyond standard pull request submission, and exploitation is straightforward: craft a malicious messages.cjs file that leverages the exposed require function. The low attack complexity (AC:L) and network accessibility (AV:N) make this practical to exploit at scale. No CVSS v3.1 severity indicates this has not been added to the Known Exploited Vulnerabilities (KEV) catalog as of the last update.

Remediation

Upgrade KanaDojo to version 0.1.18 or later, which addresses the sandbox escape by removing or properly isolating the require function passed into the vm.runInNewContext() context. Organizations should treat this as a high-priority patch given the ease of exploitation and the sensitive nature of CI/CD environments. Additionally, implement pull request review policies to require approval before code execution in automated workflows, even after patching.

Patch guidance

Apply the update to KanaDojo 0.1.18 or any subsequent stable release. Verify the patch notes confirm remediation of sandbox isolation in the issue-auto-respond.yml workflow. If you maintain a fork or custom deployment, audit vm.runInNewContext() usage to ensure no other workflows pass dangerous globals like require, eval, or process into sandbox contexts. Test the patched version in a non-production environment before full rollout to confirm compatibility with your pull request automation workflows.

Detection guidance

Monitor GitHub Actions logs for unusual require() or import statements within the issue-auto-respond.yml workflow execution context. Look for pull requests modifying messages.cjs with suspicious module imports (e.g., child_process, fs, http modules used in unexpected ways). Audit pull request history and contributor activity targeting messages.cjs, particularly from new or untrusted contributors. Review AUTOMATION_PR_TOKEN usage logs for anomalous API calls or secret exfiltration patterns. Implement code review requirements and static analysis to flag dynamic module imports in automation workflows.

Why prioritize this

This vulnerability merits immediate attention despite a CVSS score of 7.3 (HIGH) because it combines ease of exploitation, low access requirements, direct impact on CI/CD security, and potential for secret exfiltration. The issue-auto-respond.yml workflow is likely to run automatically on pull requests, requiring minimal adversary interaction. The presence of AUTOMATION_PR_TOKEN access elevates the business risk significantly. Organizations should treat this as critical if KanaDojo is integrated into production workflows.

Risk score, explained

The CVSS v3.1 score of 7.3 reflects high confidentiality and integrity impact (C:H, I:H) with no availability impact (A:N). The score accounts for network accessibility, low attack complexity, and the requirement for low-privilege authenticated access (PR:L). The unchanged scope (S:U) indicates impact is limited to the vulnerable component and systems it controls, though in practice the impact extends to secrets and downstream build artifacts. The score does not fully capture the CI/CD context where such compromises are often leveraged for supply chain attacks.

Frequently asked questions