CVE-2026-44358

Name of the Vulnerable Software and Affected Versions Espressif Shared GitHub DangerJS versions prior to 1.0.1

Description The entrypoint.sh script invokes DangerJS from the caller's workspace after copying a fork's checkout into it. This creates an untrusted search path for binary and Node.js module resolution. Consequently, a fork pull request processed by a pull request target workflow can lead to the execution of arbitrary code supplied by the fork within the action container, replacing the action's intended code.

Recommendations Update to version 1.0.1.