Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• high

  react-router RSC Mode CSRF Bypass ()

  A gap in React Router's unstable RSC request handling lets a malicious page trigger authenticated server actions on a victim's behalf, bypassing the origin check that was supposed to block cross-site…

• highCVE-2026-59714

  CVE-2026-59714: open-webui Cross-Channel Message Overwrite via Chat Completion API

  Any logged-in Open WebUI user can silently overwrite a message in a private or DM channel they have no access to, making tampered content appear under the original author's name.

• highCVE-2026-55607

  CVE-2026-55607: @anthropic-ai/claude-code Sandbox Escape via Git Worktree Path Confusion

  A malicious Git repository can trick Claude Code into creating a worktree named '.git', redirecting Git's internal config to attacker-controlled files, and ultimately writing to ~/.zshenv to execute…

• highCVE-2026-59214

  CVE-2026-59214: Open WebUI Stored Web-Worker XSS via Pyodide Same-Origin Code Execution

  A low-privileged Open WebUI user can store a Python snippet in a shared chat that, when run by an admin victim, silently creates a server-side Function containing arbitrary OS commands, giving the…

• highCVE-2026-59219

  CVE-2026-59219: Open WebUI Insufficient Session Expiration on Realtime Endpoints

  In Redis-backed Open WebUI deployments, signing out or triggering an OIDC back-channel logout correctly revokes a JWT for HTTP requests but has no effect on Socket.IO and terminal WebSocket…

• high

  js-yaml: Exponential Parsing DoS via Nested Flow Collections

  Sending a tiny YAML snippet with deeply nested flow sequences to any app that calls js-yaml's load() can freeze the Node.js process for minutes, blocking all other requests.

• critical

  kin-openapi: ValidationHandler Fail-Open Authentication Bypass

  The kin-openapi HTTP validation middleware silently skips all credential checks by default, letting unauthenticated requests through to routes your OpenAPI spec marks as protected.

• high

  netty-codec-xml XmlFrameDecoder Denial of Service via CPU Exhaustion

  Netty's XML frame decoder can be tricked into burning 100% CPU on a single EventLoop thread by trickling in a stream of malformed closing-tag fragments, making any server using it permanently…

• high

  GitPython: OS Command Injection via Single-Character Kwarg Value Token Smuggling

  GitPython's safety guard against dangerous git options can be completely bypassed by hiding a dangerous flag inside the value of a single-character keyword argument, letting attackers run arbitrary…

• highCVE-2026-15074

  CVE-2026-15074: @fastify/static Route Guard Bypass via Dot-Dot Path Traversal

  A flaw in @fastify/static lets attackers sneak dot-dot path segments past route-level authentication guards to read protected static files, without ever leaving the configured static root.

• highCVE-2026-59863

  CVE-2026-59863: Microsoft Kiota workspace.json Path Traversal to Arbitrary File Write

  A malicious or compromised repository can poison Kiota's committed workspace config so that running the normal client-regeneration command writes generated files to any location on a developer's or…

• highCVE-2026-59866

  CVE-2026-59866: Microsoft Kiota Arbitrary File Write and Code Injection via x-ms-kiota-info

  An attacker who controls an OpenAPI description can plant malicious values in the x-ms-kiota-info extension to make Kiota write generated source files outside the intended output directory and inject…