CVE-2026-55378

CVE-2026-55378 is an OS command injection (CWE-78) in the PR Branch Checker GitHub Actions workflow (.github/workflows/pr_checker.yml) of JS Recon, a JavaScript enumeration and SAST tool. In versions from 1.2.1-beta.1 through before 1.3.1-beta.2, the workflow interpolates the untrusted pull-request fields github.head_ref and github.event.pull_request.head.repo.full_name directly into a shell 'gh pr comment' command, so an attacker who opens a pull request with shell metacharacters in the branch or fork repository name can inject arbitrary commands. A successful injection executes commands on the GitHub Actions runner with the workflow's GITHUB_TOKEN, which holds pull-requests write permission, allowing the attacker to tamper with pull requests (e.g., post comments or modify PR state) and access anything available to the runner, including secrets in the workflow context. Affected parties are repositories running this workflow from JS Recon 1.2.1-beta.1 up to (but excluding) 1.3.1-beta.2 — primarily the JS Recon project's own CI and any forks that reused the workflow — rather than downstream users of the tool. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.6%, so exploitation is not currently observed.

What to do: Upgrade JS Recon to 1.3.1-beta.2 or later; if you forked the project, apply the same fix to your copy of pr_checker.yml. As mitigation, pass github.head_ref and the head repository name via environment variables instead of interpolating them directly into shell commands, and restrict the workflow GITHUB_TOKEN to the minimum permissions needed. Review workflow runs during the affected window for unexpected 'gh pr comment' activity or anomalous commands, and rotate any secrets accessible to that workflow if compromise is suspected.