PT-2026-48720 · Kanadojo · Kana-Dojo

Katriel Moses + 1 · CVE-2026-48547 · Published 2026-06-11 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions KanaDojo (affected versions not specified)

Description A command injection issue exists where an attacker with pull request access can execute arbitrary shell commands. This occurs when shell metacharacters are inserted into the version or changes fields of the 'patchNotesData.json' file. These fields are interpolated without sanitization into a child process.execSync() function call within the 'release.yml' workflow. A malicious pull request, once merged, can trigger the GitHub Actions runner, granting the attacker contents write permissions and access to the GITHUB TOKEN.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-48547

Affected Products

Kana-Dojo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48547.json · Exploit
• https://github.com/lingdojo/kana-dojo/commit/31b85a5d7c4b323ddeba3b2dc5e7807558710544 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-48547 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48547 · Vendor Advisory
• https://github.com/lingdojo/kana-dojo · Note
• https://github.com/lingdojo/kana-dojo/releases/tag/v0.1.18 · Note
• https://twitter.com/disismohi/status/2065493090698187028 · Twitter Post
• https://t.me/cveNotify/167477 · Telegram Post