PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Total.js RCE gadgets all around

lab.ctbb.show | research | #rce | #exploitation | #gadget-chain | #nodejs | #totaljs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

RCEs, RCEs…they are all around and Total.js framework will be in our scope this time
Published
Collected

Related coverage

research · lab.ctbb.show
Write Path Traversal to a RCE Art Department
# Write Path Traversal to a RCE Art Department ~/authors/fsi - profile fsi * * * Diyan Apostolov Nov 28, 2025 CriticalThinking Research members are treated as artists thus here is my small and...
vulnerability · aikido.dev
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
tool · github.com
node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)
Provides defenders and security teams with a safe, non-destructive, and high-fidelity method to scan large attack surfaces and confirm Node.js exposure to the critical Brotli decoder flaw.
Critical · advisory · github.com
GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)
Because Brotli is ubiquitous across web servers, browsers, runtimes, and package registries, any application decompressing untrusted user-supplied payload with affected decoders is vulnerable to memory corruption or RCE.
research · lab.ctbb.show
Achieving remote code execution in LangSmith Playground using unsafe template formatting
This post details the discovery and exploitation of a vulnerability in LangSmith Playground that allowed arbitrary code execution through unsafe template formatting
research · lab.ctbb.show
Vega CVE-2025-59840 - Unusual XSS Technique toString gadget chains
A writeup on the technical details of a Vega Visualization library XSS bug that uses interesting techniques to get controlled JS function execution.
Back