Can folder names be user input? If you interpolate them into a script context! yes. Swift devs often use AppleScript, but it's as dangerous as eval(). Learn about a vulnerability we found in OpenInTerminal: www.sonarsource.com/blog/escape-... #appsec #security #vulnerability

Are your data science tools safe? 🕵️‍♂️ We discovered vulnerabilities in JupyterLab Desktop and the JetBrains Jupyter plugin that can lead to code execution with minimal user interaction. Read the technical details here: www.sonarsource.com/blog/hidden-... #appsec #security #vulnerability

Shellcode execution as a service! To exploit an argument injection in Jellyfin, we searched and found a gadget in the .NET runtime to turn file writes into code execution. Learn about the bug and this new technique in our blog post: www.sonarsource.com/blog/jellyfi... #appsec #vulnerability

Can you trust the trust dialog? We discovered that running Claude Code in malicious folders could have executed system commands before the trust dialog even appears! Learn about the details in our latest blog post: www.sonarsource.com/blog/claude-... #appsec #security #vulnerability

📱 1-click RCE in the YTDLnis Android app! On Android, turning file writes into RCE is usually quite hard, but here the app had a nice gadget for us. Check out the details in our latest blog post: www.sonarsource.com/blog/ytdlnis... #appsec #security #vulnerability

Attending #Insomnihack this week? Don't miss our researcher @pspaul95.bsky.social breaking down various unsafe patterns attackers can abuse to compromise your GitHub Actions workflows!

Our team is hiring! If you are passionate about finding bugs in code, exploiting them in creative ways, and sharing your findings on our blog, apply here: jobs.lever.co/sonarsource/...

🧟 A fixed vulnerability that comes back to life? This could have happened in GitHub Actions until yesterday! Learn how attackers could have exploited seemingly fixed workflow vulnerabilities: www.sonarsource.com/blog/zombie-... #appsec #security #vulnerability

From bit flip to RCE in Ollama! 🦙 Our latest blog post explains how a file parsing bug led to an interesting out-of-bounds write primitive. Learn how it could have been exploited in Ollama, a tool to run LLMs locally: www.sonarsource.com/blog/ollama-... #security #vulnerability #llm #ai

🔄📦 GitHub Actions offer powerful automation capabilities for CI/CD, but they're not immune to attacks. Take a look at how we tackle this risk with SonarQube Cloud by diving into real-world vulnerabilities. www.sonarsource.com/blog/securin... #appsec #security #vulnerability

Using SonarQube to solve a CTF challenge? Done! ✅ Learn how we detected a 0-day vulnerability during #KalmarCTF, making us first to solve the challenge! From Zip Slip to RCE, using lazy class loading: www.sonarsource.com/blog/code-se... #appsec #CTF #vulnerability

🗒️✍️Taking a note on security: our latest blog post focuses on Go vulnerabilities, including Arbitrary File Write, XSS, and Misconfiguration. Showcasing our new support for the language in SonarQube Cloud! www.sonarsource.com/blog/securin... #appsec #security #vulnerability

📱 Ever wondered what vulnerabilities look like in Android apps? We have 2 real-world examples for you! From simple misconfig to cross-app data flow, learn how vulnerabilities manifest in the Kotlin code of Android apps: www.sonarsource.com/blog/securin... #appsec #security #vulnerability

🔓⏫ After compromising every endpoint within an organization, our “Caught in the FortiNet” blog series comes to an end with one more thing. Read more about FortiClient's XPC mistake that allows local privilege escalation to root on macOS: www.sonarsource.com/blog/caught-... #appsec #security

📁🫷🚧Can't control the extension of a file upload, but you want an XSS? Read more on how we overcame this obstacle to further exploit entire organizations using Fortinet endpoint protection: www.sonarsource.com/blog/caught-... #appsec #vulnerability #bugbountytips

🕸️🏢Caught in the FortiNet: Exploiting Fortinet’s endpoint protection solution to compromise an entire organization using minimal user interaction. Dive into our technical analysis of this interesting attack scenario: www.sonarsource.com/blog/caught-... #appsec #security #vulnerability

Catch our second talk at #TROOPERS25: 🕸️ Caught in the FortiNet: Compromising Organizations Using Endpoint Protection Yaniv Nizry will tell you the story of multiple vulnerabilities in Fortinet products that can compromise an entire organization, starting with a single click

Coming to #TROOPERS25 this week? We'll be there too, presenting our research! 🎨 Scriptless Attacks: Why CSS is My Favorite Programming Language @pspaul95.bsky.social will convince you why CSS should not be overlooked in client-side web attacks and what is possible without JavaScript today

SQL Injection despite using prepared statements? 🧐 Turns out that SQL syntax can be ambiguous! Learn how this has led to vulnerabilities in several popular PostgreSQL client libraries: www.sonarsource.com/blog/double-... #appsec #security #vulnerability

Scripting Outside the Box! 📦 Last week, we saw JS sandboxing pitfalls in API clients. Today, we continue with more complex sandbox escapes in Bruno and Hoppscotch. Learn how they work and how to sandbox JS securely in part 2: www.sonarsource.com/blog/scripti... #appsec #security #vulnerability

Ever wondered what's going on behind the scenes of your API client? 🕵️‍♀️ We dug in and found a variety of JS sandboxing pitfalls! Find out how Postman and Insomnia tried to isolate untrusted code and what challenges they faced: www.sonarsource.com/blog/scripti... #appsec #security #vulnerability

📊⚠️ Data in danger! We found an XSS vulnerability in Grafana with the help of SonarQube. Learn about the details in our latest blog post: www.sonarsource.com/blog/data-in... #appsec #security #vulnerability

🦘🛜 Our second part of the “Diving Into JumpServer” series is live: Read more on how an attacker who bypassed authentication can execute code and fully compromise the JumpServer instance and internal hosts: www.sonarsource.com/blog/diving-... #appsec #security #vulnerability

🦘🛜Compromising bastion host to gain full control over the internal infrastructure. Read more about the vulnerabilities we uncovered in JumpServer in our recent blog post: www.sonarsource.com/blog/diving-... #appsec #security #vulnerability