Security readout for executives and security teams
Plain-English summary
A malicious contributor can craft a pull request whose branch or fork name causes JS Recon’s GitHub Actions workflow to run unintended commands. Those commands execute on the CI runner with a token able to modify pull requests, potentially compromising workflow data and repository interactions.
Executive priority
Prioritize immediate remediation for public or externally contributed repositories. The attack requires only opening a pull request and can execute commands in CI with a write-capable token. Upgrade promptly, then review workflow and audit logs for suspicious activity.
Technical view
Versions 1.2.1-beta.1 through versions before 1.3.1-beta.2 interpolate untrusted pull-request values into a shell-based gh command in .github/workflows/pr_checker.yml. Shell metacharacters can produce command injection on the Actions runner. CVE records classify this as CWE-78 with CVSS 4.0 score 9.3. Version 1.3.1-beta.2 fixes it.
Likely exposure
Exposure is limited to repositories running the affected PR Branch Checker workflow from JS Recon versions at or above 1.2.1-beta.1 and below 1.3.1-beta.2. Public repositories accepting pull requests from forks face the clearest remote attack surface.
Exploitation context
An attacker needs the vulnerable workflow to process a pull request containing malicious branch or fork-name context. No repository privileges or user interaction are required according to the supplied CVSS vector. The bundle reports no KEV listing and provides no evidence of active exploitation.
Researcher notes
The vulnerable data flow is github.head_ref and github.event.pull_request.head.repo.full_name into BRANCH_NAME and SOURCE_REPO, followed by shell interpolation in gh pr comment. Reported impact is high confidentiality and integrity loss on the vulnerable system, without claimed availability or downstream-system impact. Public evidence supplied does not establish exploitation in the wild.
Mitigation direction
- Upgrade JS Recon and its workflow to version 1.3.1-beta.2 or later.
- Confirm .github/workflows/pr_checker.yml includes the upstream command-injection fix.
- Temporarily disable the affected workflow if an immediate upgrade is impossible.
- Review workflow token permissions and retain only permissions required for pull-request checking.
Validation and detection
- Identify deployed JS Recon versions and flag releases before 1.3.1-beta.2 within the affected range.
- Compare pr_checker.yml against upstream pull request 121 or commit 447876c.
- Review Actions logs for unusual commands or behavior triggered by external pull requests.
- Check repository audit records for unexpected pull-request changes associated with workflow tokens.
- Confirm the updated workflow handles untrusted branch and repository names without shell interpolation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-55378 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/js-recon/js-recon/security/advisories/GHSA-w9cj-mg3x-qjm4CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/js-recon/js-recon/pull/121CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/js-recon/js-recon/commit/447876c4bfa9ec5bc98cbc65d7a3e5f889412491CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/js-recon/js-recon/releases/tag/v1.3.1-beta.2CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.