EQST

@EQSTLab • 1,026 subscribers

#SKshieldus: Korea's leading cybersecurity firm with 20+ yrs of tech expertise & a vast customer base. #1 in full-cycle services. Contact : 1800-6400

Shorts

⚠️CVE-2026-85706 (CVSS 10.0)⚠️ Your GitLab will hand a stranger its files. 😱 No login. No account. An attacker just URL-encodes one letter of commits → %63ommits, and GitLab-Workhorse waves the request through — so a single unauthenticated POST to the repository commits API reads files straight off the server filesystem. Config, internal logs, source paths, versions… all without ever signing in. Already in CISA KEV — exploited in the wild. 🚨 If you self-host GitLab, patch to 19.1.8 / 19.2.6 / 19.3.2 now. 🔥PoC + setup: #GitLab #ArbitraryFileRead #CVE #PoC #Exploit #CyberSecurity #CVE_2026_85706

⚠️CVE-2026-85706 (CVSS 10.0)⚠️ Your GitLab will hand a stranger its files. 😱 No login. No account. An attacker just URL-encodes one letter of commits → %63ommits, and GitLab-Workhorse waves the request through — so a single unauthenticated POST to the repository commits API reads files straight off the server filesystem. Config, internal logs, source paths, versions… all without ever signing in. Already in CISA KEV — exploited in the wild. 🚨 If you self-host GitLab, patch to 19.1.8 / 19.2.6 / 19.3.2 now. 🔥PoC + setup: #GitLab #ArbitraryFileRead #CVE #PoC #Exploit #CyberSecurity #CVE_2026_85706

171,417 görüntüleme

⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️ Your Next.js OG image endpoint can hand an attacker a shell. 😱 If you use next/og on the Node runtime with sharp installed (what Next recommends for prod), one unauthenticated POST to that route runs commands on your server. Here's why: Satori builds the image as an SVG and drops your text in without escaping it, so an attacker breaks out of the tag and injects their own markup. It reaches the native image libs (sharp, libvips, librsvg, libxml2) and corrupts memory there, and since Node ships non-PIE, a hardcoded ROP chain lands execve every time. This is the default prod setup, not some weird edge case. 🚨 Not affected: edge runtime or no sharp — that path uses the wasm renderer. Patched in Next.js 16.3.6 / Satori 0.33.5. On 16.2.0–16.3.5? Update now. 🔥 PoC + setup: #Nextjs #RCE #CVE #PoC #Exploit #CyberSecurity #nextog #CVE_2026_94545

⚠️ CVE-2026-94545 (CVSS 9.5) ⚠️ Your Next.js OG image endpoint can hand an attacker a shell. 😱 If you use next/og on the Node runtime with sharp installed (what Next recommends for prod), one unauthenticated POST to that route runs commands on your server. Here's why: Satori builds the image as an SVG and drops your text in without escaping it, so an attacker breaks out of the tag and injects their own markup. It reaches the native image libs (sharp, libvips, librsvg, libxml2) and corrupts memory there, and since Node ships non-PIE, a hardcoded ROP chain lands execve every time. This is the default prod setup, not some weird edge case. 🚨 Not affected: edge runtime or no sharp — that path uses the wasm renderer. Patched in Next.js 16.3.6 / Satori 0.33.5. On 16.2.0–16.3.5? Update now. 🔥 PoC + setup: #Nextjs #RCE #CVE #PoC #Exploit #CyberSecurity #nextog #CVE_2026_94545

69,172 görüntüleme