Approved changes feed: RSS · Atom
cpe:2.3:a:lingdojo:kana-dojo:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Lingdojo (dfe5f558-e36b-55a0-8cdf-e88ebd8fe3f3) |
|---|---|
| Product | Kana Dojo (0329a7ca-22ab-5cf0-902d-5046c6f899bf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48547 |
vulnerable | 2026-07-29 00:55:01.405245 |
KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml
HIGH (7.3)
KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.
Published: 2026-06-11T18:33:14.980Z
Updated: 2026-11-08T14:04:37.079Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48546 |
vulnerable | 2026-07-29 00:55:01.404844 |
KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs
HIGH (7.3)
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.
Published: 2026-06-11T17:53:32.091Z
Updated: 2026-11-08T14:04:36.369Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.