Unauthenticated RCE in CircleCI's MCP server: Host/Origin allowlist bypassed by any non-browser client (GHSA-xv5j-cwgj-22r4)
Unauthenticated RCE in CircleCI MCP Server Explained
Remedio discovered an unauthenticated RCE flaw in CircleCI's MCP server allowing for full pipeline takeover. Learn how and why it matters »
remedio.io
Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization. I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D Details 👇 mizu.re/post/dompuri...
🔥 Want to think like a hacker and truly understand JavaScript? 💻 JavaScript for Hackers is your guide to breaking, bending, and mastering the language like never before.
We took a look at popular open-source forum platform NodeBB! This resulted in interesting vulnerabilities involving the ActivityPub protocol My favorite is *translation templates* causing XSS everywhere, requiring a large rewrite of the codebase in v4.14.0 www.aikido.dev/blog/eight-h...
Finding eight high-severity vulnerabilities in NodeBB in six hours
Eight high-severity NodeBB vulnerabilities, found by our AI Pentest in six hours. Full technical breakdown of the XSS chains, auth bypasses, and post hijacking.
aikido.dev
What started with a simple question on Discord, ended in *reviving an old XS-Leak technique* for probing status codes in background requests! Unravel the mystery with me in the latest @ctbbpodcast.bsky.social blog post: lab.ctbb.show/research/sol...
Did you know you can use HTTP header injection to trigger response queue poisoning and make it rain credentials? Learn how with the new @portswiggerres.bsky.social whitepaper "CRLF-Powered Desync Attacks: Beheading HTTP Streams" by @turtlesec.io and I. Read the full paper below 👇
