PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Achieving remote code execution in LangSmith Playground using unsafe template formatting

lab.ctbb.show | research | #rce | #uninitialized-memory | #ctbb | #langsmith
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

This post details the discovery and exploitation of a vulnerability in LangSmith Playground that allowed arbitrary code execution through unsafe template formatting
Published
Collected

Related coverage

research · lab.ctbb.show
Write Path Traversal to a RCE Art Department
# Write Path Traversal to a RCE Art Department ~/authors/fsi - profile fsi * * * Diyan Apostolov Nov 28, 2025 CriticalThinking Research members are treated as artists thus here is my small and...
research · lab.ctbb.show
The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework
# The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework ~/authors/xssdoctor - profile xssdoctor * * * Jonathan Dunn Apr 02, 2026 _How I mapped the decoding...
research · lab.ctbb.show
Slacker Slash: Bypassing Bun Security Middleware via Normalization Desync
How WHATWG URL compliance in Bun creates a normalization desync with POSIX utilities, enabling double-slash and partial-path middleware bypasses.
research · lab.ctbb.show
Can a Predicted window.open Target Really Be That Impactful?
# Can a Predicted `window.open` Target Really Be That Impactful? ~/authors/alienisgrinding - profile alienisgrinding * * * Achbani Ismail Feb 25, 2026 > **TL;DR:** A predictable `window.open()`...
research · lab.ctbb.show
Azure DevOps Agent Interception
Pivoting from a compromised Windows VM to the cloud by intercepting Azure DevOps Agent traffic
research · lab.ctbb.show
Stopping Redirects
Interesting ways to stop redirects of another site in the browser for use in OAuth and exploits requiring interaction
Back