CVE-2026-48546 — KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require functio…
Published: 2026-06-11 · CVSS: 8.5 · CVSS 4.0
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7