CVE-2026-48547: KanaDojo Command Injection in GitHub Actions Release Workflow

Technical summary

The vulnerability exists in the release.yml GitHub Actions workflow where the 'version' and 'changes' fields from patchNotesData.json are passed unsanitized into child_process.execSync(). An attacker with pull request permissions can inject shell metacharacters (e.g., semicolons, pipes, backticks, command substitution syntax) into these fields. When the workflow executes during a release, the injected commands run in the context of the GitHub Actions runner with the GITHUB_TOKEN and repository write access. This is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Business impact

Successful exploitation compromises the integrity of software releases and the repository itself. An attacker could modify package contents, exfiltrate secrets stored in GitHub environment variables, alter release artifacts, or inject malware into published packages. For projects distributing KanaDojo or using it in automated release pipelines, this creates downstream supply-chain risk—any consumers of affected releases could be compromised. The attack requires trust in contributors (pull request merge approval), so it primarily affects projects with weaker code review practices or insider threats.

Affected systems

KanaDojo projects using the release.yml workflow with the vulnerable code pattern are affected. The vulnerability is present in the workflow configuration itself, not in all versions of KanaDojo uniformly—it depends on whether a project has this specific unsanitized interpolation pattern in their release automation. Any GitHub Actions workflow that passes user-controlled or merge-controlled input directly into shell execution commands without sanitization faces the same risk.

Exploitability

Exploitability is moderate-to-high. An attacker needs valid pull request access to the repository, but the barrier to obtaining that varies by project governance. Once access is obtained, injecting the payload is straightforward—simply including shell metacharacters in JSON fields requires no special tools. The attack only triggers if the malicious pull request is merged and the release workflow is invoked, introducing a human element (code reviewer approval). However, in projects with lax review or high contributor trust, this approval step may be routine. No user interaction beyond the merge is required.

Remediation

Sanitize all external inputs before passing them to shell commands. The proper fix is to either: (1) use parameterized execution (passing arguments as an array to execSync instead of string concatenation), (2) escape shell metacharacters using a library designed for this purpose, or (3) avoid shell execution entirely by using JavaScript APIs directly. For immediate protection, restrict pull request merge permissions to trusted maintainers and enforce mandatory code review of any changes to patchNotesData.json and release workflows.

Patch guidance

Consult the official KanaDojo repository and GitHub advisories for patched versions. The fix will involve updating the release.yml workflow to safely handle the version and changes fields—look for releases that switched to parameterized command execution or input validation. When patching, test the release workflow with intentionally malicious payloads in patchNotesData.json to confirm the injection is blocked. Update any GitHub Actions workflows in your own projects that follow the same anti-pattern.

Detection guidance

Search your GitHub repository for release.yml or similar workflow files that pass JSON file contents directly into execSync() or shell commands without escaping. Audit pull requests merged in the past 30 days to patchNotesData.json or related release configuration files for suspicious shell metacharacters (backticks, $(), semicolons, pipes, &&, ||). Enable GitHub Advanced Security to scan workflows for hardcoded secrets or suspicious command patterns. Monitor GitHub Actions logs for unexpected commands executed during release workflows. If using a SIEM, correlate repository modifications with unusual child process spawning on the runner.

Why prioritize this

This vulnerability warrants HIGH priority because it directly enables code execution on a trusted system (GitHub Actions runner) with elevated permissions. The attack path requires compromise of the development pipeline rather than end-user systems, making it attractive to sophisticated attackers targeting supply-chain integrity. Although it requires pull request access, many open-source projects accept external contributions, lowering the barrier. The potential to inject malware into published releases creates cascading risk for downstream consumers.

Risk score, explained

CVSS 3.1 score of 7.3 (HIGH) reflects: Network-accessible GitHub Actions (AV:N), low attack complexity (AC:L), requirement for pull request credentials (PR:L), user interaction needed for merge approval (UI:R), no scope change (S:U), high confidentiality and integrity impact (C:H/I:H), and no availability impact (A:N). The score appropriately captures the serious nature of arbitrary command execution in a privileged context, tempered by the requirement for legitimate access and merge approval. This is not critical (8.0+) because it does not affect availability and requires authenticated access, but it is solidly in the HIGH range.

Frequently asked questions