1787 matches found
Exploit for Unchecked Return Value in Google Brotli
node2shell-check A read-only, zero-dependency POSIX sh scan...
CVE-2025-24893-POC
CVE-2025-24893 Install bun: curl -fsSL https://bun.com/install | bash To install dependencies: bun install To run: bun run CVE-2025-24893.ts This project was created using bun init in bun v1.2.19. Bun is a fast all-in-one JavaScript runtime. How to use: Usage: bun CVE-2025-24893.ts options Option...
blitzstrike
Blitz Strike Reconnaissance at speed. Analysis in depth. Validation before report. Blitz Strike is a structured penetration-testing methodology — reconnaissance, source analysis, and validation — delivered as a universal MCP server. It enumerates the attack surface BLITZ, traces source-to-sink...
NWH-Stealer-Analysis-Fileless-Bun-Runtime-Execution-Clipboard-Image-Theft-Cloud-C2-AWS-R2-
1. Binary Ninja – Open-Source Imitation & String Obfuscation The NWH Stealer sample loaded in Binary Ninja reveals a surprising technique: it heavily utilizes strings, CLI arguments, and documentation links from Bun a legitimate JavaScript runtime. By embedding legitimate text like "Learn more...
MAL-2026-18358 Malicious code in @testsecuiitytestme/cache-helper (npm)
This package installs a credential stealer and self-spreading worm. On a developer machine it exits under CI, in containers and under a debugger, the install script loads a prebuilt native addon that decodes and runs a hidden, obfuscated Bun program. That program collects npm, GitHub, GitLab, PyP...
OPENSUSE-SU-2026:12316-1 bun-1.4.4-1.1 on GA media
These are all security issues fixed in the bun-1.4.4-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-132724
These are all security issues fixed in the bun-1.4.4-1.1 package on the GA media of openSUSE Tumbleweed...
Exploit for CVE-2026-111497
AGPL-3.0 / commercial Brotli decoder exposure, with evidence...
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497 , the flaw allows crafted compressed...
Malicious code in log-rotate-testmetest (npm)
Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's implicit node-gyp rebuild to execute index.js at install time...
Malicious code in net-codec-testmetest (npm)
Source: amazon-inspector 7bf1dbafca56ccfcb849f9ebb80b7a1cdf42007fd12618492620e0f7660476b2 The package has no native source files but ships a binding.gyp whose sole target is type:'none' and whose sources array uses GYP command expansion !env node index.js... to execute index.js during node-gyp...
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the...
Malicious code in net-codec-testmetest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1dbafca56ccfcb849f9ebb80b7a1cdf42007fd12618492620e0f7660476b2 The package has no native source files but ships a binding.gyp whose sole target is type:'none' and whose sources array uses GYP command expansion !e...
MAL-2026-18186 Malicious code in net-codec-testmetest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1dbafca56ccfcb849f9ebb80b7a1cdf42007fd12618492620e0f7660476b2 The package has no native source files but ships a binding.gyp whose sole target is type:'none' and whose sources array uses GYP command expansion !e...
MAL-2026-18185 Malicious code in log-rotate-testmetest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's...
Malicious code in log-rotate-testmetest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's...
MAL-2026-18182 Malicious code in test-brotli2-testmetest (npm)
test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...
@aguil/agents (>=0.8.1, <=0.9.2), @akasecurity/claude-tools (>=0.5.1, <=0.5.5) +108 more potentially affected by CVE-2026-111497 via bun (>=1.0.2, <=1.4.3)
bun NPM version =1.0.2, =0.8.1, =0.5.1, =18.0.1, =0.1.34, =0.1.2-bootstrap.0, =0.2.0, =0.0.1, =0.1.0-next.38, =0.1.0-next.38, =2.5.6, =1.0.57, =2.8.0-cs.1, =0.1.0, =0.0.5, =0.0.16 and more Source cves: CVE-2026-111497 Source advisory: SNYK:JS-BUN-21717226...
Out-of-bounds Write (HTTP2Shell)
Overview Affected versions of this package are vulnerable to Out-of-bounds Write HTTP2Shell via block-switch handling in the Brotli decoder, specifically DecodeBlockTypeAndLength in deps/brotli/c/dec/decode.c. An attacker can execute arbitrary code by supplying a crafted Brotli-compressed stream...
