CVE-2026-55378

Name of the Vulnerable Software and Affected Versions JS Recon versions 1.2.1-beta.1 through 1.3.1-beta.1

Description The PR Branch Checker workflow in .github/workflows/pr checker.yml improperly handles untrusted values. Specifically, the github.head ref and github.event.pull request.head.repo.full name values are assigned to the BRANCH NAME and SOURCE REPO variables and then interpolated into a shell gh pr comment command. A remote attacker can use shell metacharacters within a branch or fork name to execute arbitrary commands on the GitHub Actions runner using the GITHUB TOKEN, which possesses write permissions for pull requests.

Recommendations Update to version 1.3.1-beta.2.