Vulnerability analysis, proof of concepts, and code reviews
toml for npm rebuilt every dotted key's full path at every segment, so one long key cost O(n²) time and memory. A 100 KB key froze the event loop for 6.8 seconds, and around 200 KB crashed Node with an out-of-memory error that try/catch can't stop. GHSA-9j65-hcg3-gc64, fixed in 5.0.1.
Trigger.dev runs background jobs and AI agents for more than 30,000 developers. Its query API adds an organization filter to each table, but a table name in {braces} skipped it, so any API key could read the rows of all tenants. The fix shipped in 4.7.3, one day after my report.
Two FacturaScripts advisories, same product, same day. A path traversal in the mail attachment handler emails config.php to an attacker (CVSS 9.9). A Deploy endpoint signed with md5 of the database password lets anyone disable every plugin (CVSS 7.5). The first bug hands you the key to the second.
Notes from SkillBit's Flash CTF: seven challenges across forensics, reversing, web and misc. Six of them fell in a few minutes each, and the seventh taught me something, because my registry parser was a leaky abstraction over the evidence and it leaked silently.
mcp-from-openapi added an SSRF guard to protect internal services and cloud metadata. It resolved the hostname once to validate it, and then called fetch(), which re-resolved it at connection time. How a classic DNS TOCTOU slips into modern async JavaScript, why blocklist hardening can't fix it, and what it actually takes to pin a socket.
The alt text health report in @jhb.software/payload-alt-text-plugin scanned every tenant with overrideAccess: true and flattened Where-based read rules to a yes, handing any logged-in user counts and up to 100 document IDs from rows they cannot read. GHSA-3pmw-vxv3-8vgq, CVSS 4.3, fixed in 0.13.0.
Two advisories I filed against argos-javascript: the documented debug flag dumps GITHUB_TOKEN and ARGOS_TOKEN into CI logs, and the OAuth login echoes attacker-controlled ANSI into your terminal. Both fixed within a day.
Kimai locked its project report behind a permission check and left the export route beside it open. Any logged-in user could download customer names, project names, and budget metadata across every customer. Advisory GHSA-pvc4-crg3-gj44, CVE-2026-80194, patched in 2.64.0.
One credential has 14 names because three standards bodies and a marketing coalition all held authority to name it and none held authority to stop. The passkey vocabulary mess is a governance problem, not a spelling one.
A ROLE_TEAMLEAD user in Kimai 2.56.0 could set systemAccount:true on their own profile through the user API and disappear from every billing report, every user dropdown, and every teammate's view. One missing permission check. Patched in 2.57.0, credit in the release notes.
CVE-2026-31431 is a logic bug in the Linux kernel's crypto API that gives any local user root through a 732-byte Python script. No race conditions, no kernel offsets, no recompilation. Same script, every distro, every time. It's been sitting there for nine years.
Five CVEs disclosed in Tryton ERP through responsible disclosure -- stored XSS that escalates to unauthenticated via email, access control bypasses on data exports, and stack traces handed to any logged-in user. All patched, all basic, all in production for years.
Anthropic caught three Chinese AI labs running coordinated model distillation attacks at scale. 24,000 fraudulent accounts, 16 million stolen exchanges, and capabilities extraction targeting AI safety research and censorship circumvention. The AI cold war just went hot.
CVE-2025-23266 (NVIDIAScape) lets you escape Docker containers and get root on the host with a 3-line Dockerfile. Affects NVIDIA Container Toolkit used by 37% of cloud environments. Plus runc CVEs that break Kubernetes isolation.
Trust Wallet's browser extension got backdoored via supply chain attack on Christmas Eve. Attackers pushed malicious code to production that drained $7M in user funds. Binance-owned wallet, developer negligence, APT-level execution.
A victim loses $50 million USDT to an address poisoning attack because wallet developers can't be bothered to implement basic checksum validation. I demonstrate how trivial it is to generate matching addresses.
React Server Components gets absolutely demolished by CVE-2025-55182. I demonstrate root RCE because apparently Meta's security team forgot about input validation.