Read the docs
TI-2026-35905 Aliases CVE-2026-48546GHSA-mq42-j95v-p3gq

KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs

Priority LOW 39CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00487 42nd percentileScored 2026-11-07
Fix Fixed kana-dojo (lingdojo): 0.1.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lingdojokana-dojobefore 0.1.180.1.18Patch availableCNA
  • kana-dojo Vendorlingdojo Affected before 0.1.18 Fixed in 0.1.18 Patch available CNA

Remediation

  • Fix · CNA kana-dojo (lingdojo) Fixed in 0.1.18

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    lingdojo kana-dojo 0.1.18

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-35906 KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.ymlPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48546
  2. 2026-10-03 Alias added: GHSA-mq42-j95v-p3gq
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-25 Priority changed: MEDIUM → LOW

References

Patch 1

Other 1

  • TI-2026-35906 KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences