CyberRota Analysis
AI-GeneratedThe JS Recon tool in versions 1.2.1-beta.1 to 1.3.1-beta.2 is vulnerable due to improper handling of untrusted input in the PR Branch Checker workflow, allowing remote users to execute arbitrary commands in the GitHub Actions runner using shell metacharacters in branch or fork names. This critical vulnerability can lead to unauthorized access and manipulation of repositories, making it essential for users of affected versions to upgrade to 1.3.1-beta.2 immediately to mitigate risks. Organizations utilizing this tool, particularly those with active pull request workflows, should prioritize remediation to protect their codebases and CI/CD pipelines.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/pr_checker.yml places github.head_ref and github.event.pull_request.head.repo.full_name into BRANCH_NAME and SOURCE_REPO and interpolates those untrusted values into a shell gh pr comment command. A remote user who opens a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.