Research.

OS Command Injection (CWE-78) in the v2-dev branch of im3x/Scriptables: unsanitized input passed to a shell, leading to arbitrary command execution on the server. From proof of concept to maintainer notification and MITRE assignment.

Zip Slip / Path Traversal (CWE-22) in codeskyblue/gohttpserver v1.3.0: a malicious archive extracts files outside the intended directory, allowing writes to arbitrary host paths.

Argument Injection (CWE-88) in Tzahi12345/YoutubeDL-Material: download parameters (customArgs) on POST /api/downloadFile flow unfiltered into yt-dlp arguments, where --exec runs arbitrary commands on the server. Unauthenticated endpoint.

Insecure deserialization (CWE-502) in LiangYang666/ChatGPT-Web: the POST /uploadUserDictFile endpoint feeds a user-uploaded .pkl file to pickle.load, executing arbitrary Python code. Default configuration ships with empty passwords.

Insecure deserialization (CWE-502) in ltzheng/agent-studio (ICLR 2025 paper project): POST /task/eval reconstructs arbitrary Python objects via jsonpickle.decode, yielding unauthenticated RCE. The server binds to 0.0.0.0 by default.

OS Command Injection (CWE-78) in develon2015/Youtube-dl-REST: the recode parameter on GET /y2b/download is interpolated into a shell command passed to child_process.execSync without sanitization. Unauthenticated.

OS Command Injection (CWE-78) in kudlav/videoeditor: the filename of a file uploaded via POST /api/project/{id}/file is interpolated unquoted into an ffmpeg command run with child_process.exec. Unauthenticated chain (create project then upload).

Insecure deserialization (CWE-502) in maxpumperla/elephas (<=3.2.0): the parameter server feeds the body of POST /update to pickle.loads, executing arbitrary code in the Spark driver. Unauthenticated.

Server-Side Request Forgery (CWE-918) in Tiendil/feeds.fun (1.28.0): the feed-discovery endpoints fetch a user-supplied URL with follow-redirects and no filtering of internal IPs or cloud metadata, exposing IAM credential theft and internal reconnaissance.

Insecure deserialization (CWE-502) in antmicro/protoplaster (1.0): POST /api/v1/exec feeds a crafted Python pickle to pickle.loads before any validation, yielding remote code execution. Waitress server on 0.0.0.0, no authentication.

Path Traversal (CWE-22) in Tanq16/local-content-share (v37): the /download, /raw, /edit, /delete and /rename handlers accept unnormalized %2f traversal, allowing arbitrary file read, write and delete on the host. Unauthenticated.

Insecure deserialization (CWE-502) in stepfun-ai/Step-Video-T2V: the /vae-api and /caption-api endpoints feed the request body to pickle.loads, executing code in the inference process. Binds to 0.0.0.0:8080 with no authentication.

Path Traversal (CWE-22) in wizsk/goshare (v4.4): in the default no-password configuration, GET /zip with %2f traversal allows reading arbitrary files outside the shared directory (e.g. /etc/passwd).

Path Traversal (CWE-22, CVSS 9.8) in phpk's GodoOS: validateFilePath() only checks that the path is non-empty, leaving 14+ unauthenticated endpoints free to read, write and delete arbitrary files on the host. Advisory in coordinated disclosure, CVE pending.

Responsible disclosure to Anthropic of a bypass of Claude Code’s safety guardrails. Handled privately with the vendor: the technical details remain confidential.

Insecure deserialization (CWE-502) in Antmicro protoplaster 1.0 (commit d396d8cc): remote code execution through the execution.py, consts.py and protoplaster.py components. The POST /api/v1/exec endpoint feeds untrusted data to pickle.loads on a waitress server listening on 0.0.0.0 with no authentication.

On a major SaaS customer support platform (engagement under NDA): indirect prompt injection (RAG poisoning) on its AI agent. A poisoned knowledge base article drives the AI to generate phishing replies - asking for the password and redirecting to a malicious URL - sent from the official channel with valid DKIM/SPF/DMARC and no human review. Full chain demonstrated end-to-end with .eml proof (OWASP LLM01).

Unauthenticated admin endpoints on the Pyroscope data-plane port enable cross-tenant data access (High, 8.6).

Custom authentication headers (X-API-Key, X-Auth-Token) forwarded to the target of a cross-domain redirect instead of being stripped: a credential leak in the follow-redirects module, axios's redirect dependency. Same class confirmed in five other HTTP libraries; fix shipped in 1.16.0.

Incomplete fix of a path traversal in pghoard delta backup restore (Aiven): arbitrary file write outside the pgdata directory.

Server-Side Request Forgery (CWE-918) in Tiendil feeds.fun release-1.28.0: the feed-discovery endpoints POST /spa/api/private/discover-feeds and /add-feed let an attacker obtain sensitive information (cloud metadata, IAM credentials) and reach internal resources, fetching user-supplied URLs server-side with no internal-IP filtering.

Hardcoded Session Secret (CWE-798) in codeskyblue/gohttpserver v1.3.0: a static session key in the source, opening the door to session token forgery. Rescored to 7.5 in triage (the gate guards writes, not reads).

Dangling CNAMEs on railing.meraki.com and heroku.meraki.com point to a registered but inactive Heroku application: subdomain takeover risk.

SSRF in webhook URL validation: no internal IP filtering, with full response body disclosure. Resolved by the vendor.

Directory Traversal (CWE-22) in Tanq16 local-content-share (all releases through tag v37): the main.go /download, /raw, /edit, /delete and /rename handlers accept unnormalized traversal, allowing arbitrary file read, write and delete on the host without authentication.

For a FedRAMP-regulated government SaaS provider (engagement under NDA): AWS Cognito pool credentials exposed in a public config file, enabling unauthenticated user enumeration (PreventUserExistenceErrors disabled) and unthrottled credential stuffing. Full chain demonstrated, from reconnaissance to the conditions enabling account takeover.

Sensitive headers (Authorization, Cookie) not stripped when the client follows a redirect to a different origin: a cross-origin credential leak. Confirmed in Node.js’s global fetch, where undici is vendored.

Same class in the npm client node-fetch: authentication headers survive a redirect to a different host, exposing them to the destination origin.

In the Go client resty: user-set headers are not cleared on a cross-origin redirect, leaking tokens and cookies to the new destination.

Directory Traversal (CWE-22) in wizsk goshare through tag v4.4 (commit 37a755d8): the /zip HTTP endpoint allows path traversal and reading of arbitrary files outside the shared directory in the default no-password configuration.

In the Go client req: the same leak class: sensitive headers are forwarded to a new origin when following a redirect, with no sanitization.

In the Go client gorequest: authentication headers forwarded to a new origin after the redirect, closing the set of six HTTP libraries hit by the same class.

Credentials preserved across an HTTP→HTTPS same-host redirect when only the port changed: the same-host check compared host and scheme, not the port. Reported on March 20, fixed within six days (PR #12275); closed without a CVE as the code lived only on the v4 development line, never in a release.

Insecure deserialization (CWE-502) in stepfun-ai Step-Video-T2V (commit 675e08c0): remote code execution through the VAEapi and Captionapi flask-restful resources of api/call_remote_server.py, which feed the request body to pickle.loads on 0.0.0.0:8080 with no authentication.

Incorrect EIP-712 struct hashing of dynamic types in GuardedMulticaller2: the struct is not encoded per the standard, with risk to signature validation.

Cross-user Kafka consumer hijacking via consumer identifier enumeration in the REST proxy, enabling unauthorized message exfiltration.

Authorization bypass in Grafana nested-folder permissions (Medium, 6.5).

Unauthenticated application version disclosure via the /version endpoint, useful to an attacker for fingerprinting.

SDK sandbox network isolation bypassable: access to the host's Prometheus metrics through the Docker bridge.

SSRF and internal network scanning via the SECURITY DEFINER function aiven_extras.pg_create_subscription().