PT-2026-44387 · Espressif · Dangerjs

Avivdon · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-44358

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Espressif Shared GitHub DangerJS versions prior to 1.0.1

Description The entrypoint.sh script invokes DangerJS from the caller's workspace after copying a fork's checkout into it. This creates an untrusted search path for binary and Node.js module resolution. Consequently, a fork pull request processed by a pull request target workflow can lead to the execution of arbitrary code supplied by the fork within the action container, replacing the action's intended code.

Recommendations Update to version 1.0.1.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

CWE-829

Related Identifiers

CVE-2026-44358

GHSA-WM3P-PV54-6W73

Affected Products

Dangerjs

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44358.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-44358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44358 · Security Note
• https://github.com/espressif/shared-github-dangerjs/commit/d742408028135ea200982b5b2e3e438dc4e5a25d · Note
• https://github.com/espressif/shared-github-dangerjs/security/advisories/GHSA-wm3p-pv54-6w73 · Note