Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If your Node.js service runs untrusted code in vm.runInNewContext(), you probably have CVE-2026-48546. Here is what actually isolates JS and what does not.
Post summary
The statement refers only to CVE-2026-48546 in the context of Node.js code execution, without providing any proof of concept, exploitation evidence, patching guidance, or deeper technical specifics.