CVE-2026-48547
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json. These inputs are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow.
Risk Assessment
Attackers can submit a malicious pull request that, when merged, triggers the GitHub Actions runner with write permissions, posing a serious security risk to the system.
Recommendation
It is recommended to implement input sanitization for the version and changes fields in the patchNotesData.json file and to restrict pull request access to trusted users.
Original NVD description (English source)
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.