External risk intelligence

JS Recon Pull Request Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-55378

The vulnerability exists within a GitHub Actions workflow file used for pull request automation. This is a developer-centric, build-time process that runs in an isolated CI/CD environment, not a public-facing service, web application, or internet-accessible network appliance.

OS Command Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in JS Recon, a tool used for JavaScript enumeration and static analysis. The issue, present in certain beta versions, allows a remote attacker who opens a pull request to potentially execute commands on the GitHub Actions runner. This could grant unauthorized access and control over the runner environment, which may hold sensitive information or permissions. The main concern is confirming relevance and exposure to your development and CI/CD pipelines.

Allows remote code execution on build servers.
Impacts code review and software supply chain integrity.
Focus on verifying exposure in CI/CD pipelines.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by creating a pull request with a specially crafted branch or fork name containing shell metacharacters. This allows them to execute commands on the GitHub Actions runner, leveraging the workflow's GitHub Token to gain write permissions for pull requests.

Requires creating a pull request.
Exploits untrusted input in branch names.
Risks command execution and token compromise.

Live Threat

Current exploitation, exposure, and threat context

A remote user who opens a pull request could execute arbitrary commands on the GitHub Actions runner. This is possible when the workflow interpolates untrusted values from branch or fork names into a shell command, when supported by the advisory.

Workflow runner commands.
Malicious branch or fork name.
Runner code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the JS Recon tool, specifically its PR Branch Checker workflow. Given that this is a developer tool used in a CI/CD pipeline, the Platform Engineering or DevOps team responsible for managing the build and release infrastructure is likely to own this issue. The immediate first step should be to identify all instances of JS Recon within the development and CI/CD environments, assess their reachability and criticality, and then coordinate remediation with the development teams.

Platform/DevOps teams own the fix.
Verify JS Recon usage in CI/CD.
Update JS Recon to a non-vulnerable version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JS Recon?

JS Recon is a technical tool designed for JavaScript enumeration and static application security testing (SAST). Developers integrate this software into their workflows to automate code analysis and security assessments. Because it functions as a build-time utility, it is typically used within development environments to identify issues before software is deployed.

What is the vulnerability in CVE-2026-55378?

This vulnerability is an instance of OS Command Injection, classified as CWE-78. It occurs when a software process improperly handles untrusted data, allowing that data to be interpreted as a system command. In this specific case, the tool's automation logic fails to sanitize input from branch or repository names before passing them into a shell command, which grants an attacker the ability to execute unauthorized code on the build system.

How can an attacker trigger this vulnerability?

An attacker initiates the vulnerability by opening a pull request containing a branch or fork name designed with specific shell metacharacters. If the PR branch name is standard and lacks these characters, the command execution process is not triggered. The vulnerability is fundamentally tied to the handling of external input during the automated workflow process rather than general usage of the tool itself.

Is my organization at risk from CVE-2026-55378?

According to Halo Surface Signal, this risk is assessed as very unlikely for standard public-facing services. The vulnerability is contained within a CI/CD build-time process rather than an internet-accessible web application. You should evaluate your exposure by checking if your internal development pipelines utilize the affected GitHub Actions workflow for pull request automation.

What are the first steps to fix this?

The primary response is to audit your development and CI/CD pipelines to identify any active use of the affected JS Recon versions. Once located, your DevOps or platform engineering team should prioritize updating the tool to version 1.3.1-beta.2 or later, which contains the necessary security fixes to handle input safely. Coordinating with your development leads ensures that all build-time automations are remediated without disrupting your release processes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.