CVE-2026-48546: KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs

Synopsis

A sandbox escape vulnerability in KanaDojo before 0.1.18 allows a network-accessible attacker with a low-privilege account to execute arbitrary code by exploiting the explicit passing of Node.js's global require function into a vm.runInNewContext() sandbox in the issue-auto-respond.yml GitHub Actions workflow. The attacker submits a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox isolation entirely. Successful exploitation grants full GitHub Actions runner privileges, including access to the AUTOMATION_PR_TOKEN secret. A patched-image rebuild at version 0.1.18 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GitHub Actions workflow over the network by submitting a pull request to the target repository; the vulnerable code path is triggered remotely through standard VCS interaction.

• AuthenticationRequired

  The attacker must hold a GitHub account with permission to submit a pull request, meaning any low-privilege contributor account is sufficient to trigger the vulnerable workflow.

• Victim interactionRequired

  A repository maintainer or automated process must evaluate or approve the pull request, making victim interaction a prerequisite for the malicious messages.cjs payload to execute.

• Attack complexityDetail

  Attack complexity is low: no race conditions or special environmental conditions are required; the exploit path is straightforward and reliably reproducible once a pull request is accepted into the workflow.

Blast Radius

• The attacker reads secrets available to the GitHub Actions runner, including the AUTOMATION_PR_TOKEN, which can be used to authenticate as an automated identity against the repository and any systems it has access to.
• The attacker executes arbitrary code with full GitHub Actions runner privileges, enabling modification of repository contents, CI pipeline artifacts, or downstream deployment targets.
• Arbitrary Node.js modules can be imported and executed, allowing the attacker to exfiltrate environment variables, credentials, and any files accessible to the runner process.