codeql-sample-polkit

-- coding: utf-8 - - polkit pkexec 漏洞 概述 本仓库使用 CodeQL 研究 polkit pkexec 漏洞。 包含 构建数据库的说明 构建好的数据库 一系列用于演示如何发现该漏洞的查询 已完成事项： polkit 源码 / 数据库构建 针对易受攻击源码的 codeql 查询 CFG 图示 待办事项： 增强 codeql 查询以同时处理已修补的源码 命令行说明 漏洞详情 Polkit pkexec 漏洞...

CVE-2021-38297

CVE-2021-38297 の悪用: GO Wasm バッファオーバーフローの脆弱性 脆弱性の概要 WebAssembly WASM は、最新の Web ブラウザの大部分で実行可能なバイナリ命令フォーマットです。C、C++、Rust、GO などのさまざまな高水準言語のコンパイルターゲットとして機能し、これらの言語で記述されたコードを WASM にコンパイルできます。 CVE-2021-38297 は、GO による GO コンパイル済み WASM バイナリのコンパイルとロードにおける重大なバグを浮き彫りにしています。この脆弱性は、GO が提供する JS wasm ローダー...

CVE-2024-52301

CVE-2024-52301 POC この脆弱性はCVE-2024-50340の脆弱性に基づいています。 必要条件 PHP設定ファイル（php.ini）で registerargcargv オプションが有効になっている必要があります。この設定により、コマンドライン引数とクエリパラメータが $SERVER'argv' に読み込まれます。 https://www.php.net/manual/en/ini.core.phpini.register-argc-argv 脆弱なコードの説明 //Illuminate\Foundation\Application public function...

CVE-2021-4034

CVE-2021-4034 pkexec を介したローカル特権昇格 YouTube 動画 次の ✨ YouTube 動画 を視聴してください。 ローカルでの実行 make all && ./pwnkit && make clean Docker での実行 Build the docker image docker build -t pwnkit . Run the exploit docker run -it pwnkit bash make all && ./pwnkit && make clean snyk-cli を使用した検出 snyk container test...

ROOT-APP-NPM-AIKIDO-2026-455143 AIKIDO-2026-455143 in @simple-git/argv-parser - Patched by Root

Root has patched AIKIDO-2026-455143 in the @simple-git/argv-parser package for Root:npm. Multiple fixed versions available...

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

Security control bypass in @simple-git/argv-parser: Git's VISUAL editor fallback is not classified as allowUnsafeEditor Report metadata | Field | Value | | --- | --- | | Package | @simple-git/argv-parser npm, pkg:npm/%40simple-git/argv-parser | | Repository | https://github.com/steveukx/git-js | ...

GHSA-V5RQ-49VH-5V5C simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

Security control bypass in @simple-git/argv-parser: Git's VISUAL editor fallback is not classified as allowUnsafeEditor Report metadata | Field | Value | | --- | --- | | Package | @simple-git/argv-parser npm, pkg:npm/%40simple-git/argv-parser | | Repository | https://github.com/steveukx/git-js | ...

EUVD-2026-89336

simple-git: VISUAL editor environment variable is omitted from unsafe editor detection...

CVE-2026-46529

通过PDF argv注入实现RCE CVE-2026-46529 atril/xreader/evince evspawn shell/ev-application.c 中 argv 注入的有效概念验证。在精心构造的PDF渲染页面上任意位置单击一次，即可利用运行查看器的用户权限执行任意代码。 此版本使用%f替换技术：dlopen目标路径由查看器本身在运行时发现，因此攻击者无需知道多格式文件在受害者文件系统中的任何位置（无需用户名、无需$HOME、无需下载目录）。 POC...

CVE-2021-38297-Go-wasm-Replication

🚨 利用 CVE-2021-38297：深入 GO Wasm 缓冲区溢出之旅 🚨 🌐 漏洞概述 🌐 WebAssembly（WASM）🌍 作为一种前沿的二进制指令格式，能够在现代 Web 浏览器中无缝执行 C、C++、Rust 和 GO 等高级语言。然而，CVE-2021-38297 🚩 的发现揭示了 GO 在编译和加载 GO 编译的 WASM 二进制文件过程中存在一个严重缺陷。该漏洞位于 GO 提供的 JavaScript WASM 加载器（wasmexec.js）中，允许在 argv 参数中无限制地包含数据。由于 argv 存储在 WASM 的线性内存中，恶意行为者可能利用过大的...

CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

UBUNTU-CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

EUVD-2026-90576

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

CVE-2026-103431

The collectl utility, specifically the colmux component in versions before 4.3.20.2 , fails to sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances. A local user on a monitored host can exploit this by providing a crafted process name (argv[0]) to inject e...

Rocky Linux 8 [CIQ] Security Update: evince / evince-browser-plugin / evince-browser-plugin-debuginfo / etc (crlsa-2026_28998)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628998 advisory. atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-46529 Tenable has extracted the preceding...

CVE-2026-103431: Improper Neutralization of Escape, Meta, or Control Sequences

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

Rocky Linux 9 [CIQ] Security Update: evince / evince-debuginfo / evince-debugsource / evince-libs / etc (crlsa-2026_27819)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202627819 advisory. atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-46529 Tenable has extracted the preceding...

CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

Arbitrary Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the detect-vulnerable-config-writes path in the argv-parser package, where unsanitised arguments passed to git...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the prepareEnv function in parse-env.ts, which fails to recognize the VISUAL environment variable as a tracked unsafe editor key. Because VISUAL is not included in the GitEnvKeys map, it is silently discarded befor...