CVE-2026-44358 affects Espressif Shared GitHub DangerJS, a reusable GitHub Action CI workflow. Prior to version 1.0.1, the action's entrypoint.sh created an untrusted search path vulnerability by invoking DangerJS from the caller's workspace after copying fork checkouts. This allowed malicious fork pull requests processed by pull_request_target workflows to execute arbitrary code inside the action container. The vulnerability enables supply chain attacks through GitHub Actions and has been fixed in version 1.0.1.