CVE-2026-48547
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json. These fields are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow.
Risk Assessment
An attacker can submit a malicious pull request that, when merged, triggers GitHub Actions with contents write permissions and access to GITHUB_TOKEN, potentially leading to repository takeover, data theft, or further attacks on the CI/CD infrastructure.
Recommendation
Immediately update KanaDojo to the latest patched version. Additionally, implement input sanitization for the version and changes fields and avoid using child_process.execSync() with user-supplied data.
Original NVD description (English source)
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.