CVE-2026-55378

score

<0.1

cvss

—

epss

0.8%

published

2026-08-28

kev added

—

first seen

2026-10-21

JS Recon 1.2.1-beta.1 to 1.3.1-beta.2 contains a command injection caused by unsanitized interpolation of untrusted branch and repo names in GitHub Actions workflow, letting remote attackers execute commands with GITHUB_TOKEN permissions, exploit requires opening a pull request with crafted branch or fork name.