amla-sandbox

amla-sandbox This repository is the release source for the amla-sandbox Python package. Development happens in the amlalabs monorepo; this repo is updated on release. The Rust runtime that compiles to amlasandbox.wasm lives in amla-sandbox-core; the exact release tag this Python package was built...

CVE-2024-2887-REPORT

SSD Advisory – Google Chrome RCE Source: ssd-disclosure.com/ssd-advisory-google-chrome-rce Summary A critical remote code execution vulnerability in Google Chrome versions 123 and earlier affecting WebAssembly WASM garbage-collection type handling. The bug allows type confusion that can be...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...

CVE-2021-38297

Exploiting CVE-2021-38297: Vulnerability in GO Wasm Buffer Overflow Overview of the Vulnerability WebAssembly WASM serves as a binary instruction format executable in most modern web browsers. It acts as a compilation target for various high-level languages like C, C++, Rust, and GO, allowing cod...

CVE-2018-4121

CVE-2018-4121 - Exploit RCE de Prueba de Concepto de Secciones Wasm de Safari por MWR Labs c 2018 Detalles este exploit de prueba de concepto apunta únicamente a Safari 11.0.3 13604.5.6 en macOS 10.13.3 17D47. compile el payload de su elección como un dylib con un constructor ejecute python...

CVE-2025-31125

CVE-2025-31125 漏洞利用 - Vite WASM 导入路径遍历 🛡️ 此脚本是针对 CVE-2025-31125 （Vite 中发现的一个漏洞）的 概念验证 PoC 利用程序。该漏洞利用 WASM 导入路径遍历 问题，从运行 Vite 框架的易受攻击服务器中检索敏感文件。它允许攻击者访问诸如 /etc/passwd、/etc/shadow、/etc/hosts 以及服务器暴露的其他敏感文件。 ⚠️ 🚨 免责声明 此工具仅供教育目的 ，且仅应在您拥有或已获得明确测试许可的系统上使用 。未经授权访问系统是违法的 ，可能导致法律后果。请负责任地使用此工具 ！ ⚖️ ✨ 功能特性 利用...

py_trustwallet_wasm

This repository does not have a README...

ephemora-cell

Ephemora Cell The execution layer for untrusted AI-generated code. Fast, capability-based WASM execution with explicit CPU, memory, time, I/O, and filesystem limits — sub-millisecond warm execution with sign-ready execution records RFC 8785 JCS canonicalization + ES256sign/verify primitives. Buil...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, pero con wasm Estado: PoC de fallo validado con secuestro de flujo de control demostrado pc del fallo = veneno de celda liberada 0xcdcdcdcdcdcdcdcd bajo el shell de depuración — el motor salta a un puntero leído del ICScript liberado. Trabajo restante: controlar los bytes reclamado...

CVE-2026-2764-but-with-wasm

CVE-2026-2764, pero con wasm Estado: análisis + PoC validado. Weaponización de la primitiva en curso. Una cadena estilo WasmBlazeFox construida sobre un bug de 2026 esta vez: CVE-2026-2764, una «miscompilación JIT + use-after-free» de IonMonkey/baseline en el componente JavaScript Engine: JIT,...

CVE-2026-9973-exploit

CVE-2026-9973 Corrección de errores https://chromium-review.googlesource.com/c/v8/v8/+/7822799 root@kitploit: wasmturboshaft Fix Phi handling in Load Elimination some more Multiple Phis can depend on each other, so we have to clear all their replacements up front. Fixed: 509268941 Change-Id:...

V8-sbx-bypass-collection

Colección de escapes/bypasses/violaciones del sandbox de V8 y VR Una colección de enlaces relacionados con VR del sandbox de V8 y explotación Contenido IssueTracker Articles Papers & Slides Design documents IssueTracker 2023: "issue id: 40940619, Escape del sandbox de V8 debido a que las etiqueta...

Exploit for Out-of-bounds Write in Google Chrome

CVE-2026-85046 + CVE-2026-87491 Was doing a ton of reading ov...

pii-shield v2.2.3

PII-Shield 🛡️ Zero-code log sanitization sidecar for Kubernetes. Prevents data leaks GDPR/SOC2 by redacting PII from logs before they leave the pod. PII-Shield runs in-process — CLI, sidecar, or WASM. There is no hosted API and no server your data is sent to. "Don't let PII poison your AI models."...

trivy-module-wordpress

Trivy WoredPress Module This module provides a more in-depth investigation of Wordpress detection. Set up root@kitploit: $ tinygo build -o wordpress.wasm -scheduler=none -target=wasi --no-debug wordpress.go $ mkdir -p /.trivy/modules $ cp wordpress.wasm /.trivy/modules It is also available in GHC...

toy-wasm-symbexp

toy-wasm-symbexp Este es un intérprete simbólico WASM de juguete. Ilustra los siguientes artículos: Parte 1 - Introducción Parte 2 - Escribiendo un intérprete concreto - explorar el código en esta etapa Parte 3 - Escribiendo un intérprete simbólico - explorar el código en esta etapa Parte 4 -...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...

CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm

CVE-2026-85046 Vi el otro POC de esto y pensé para mí mismo que es una pesadilla de ver. Así que fui y simplifiqué el POC y añadí un salto a tu propio wasm. Porque wasm. Chrome 152.0.7977.75 puede confundir punteros de objetos con enteros durante sort. poc.js mantiene una referencia obsoleta al...

CVE-2026-6307

CVE-2026-6307: V8 JS-to-Wasm type confusion → RCE on Chrome 146 Local reproduction and weaponization of the V8 JS-to-Wasm deoptimization type confusion described by Nebula, taken to a xcalc popped from the renderer of Chrome for Testing 146.0.7680.165 the bug is fixed in 147.0.7727.101. All...