Web Security | jankesec

Root Cause AnalysisNov 10, 202617 min read

CVE-2026-125330: Cross-Workspace Session Access with a HarnessRouter Workspace Key

Root-cause analysis of CVE-2026-125330: HarnessRouter narrowed the session list to an API key's workspace, but the routes that take a session or response id checked only the organization. A workspace key that knew another workspace's session id could read, overwrite, publish and delete that session. Fixed in 0.31.7.

#vulnerability-research#access-control#ai-security#web-security

Patch AnalysisOct 20, 202610 min read

CVE-2026-112950: Windows Backslash Traversal in @vitest/mocker

Root-cause analysis of CVE-2026-112950: on Windows, a redirect mock path containing a backslash passes the Vite allowlist check added by the first fix and then reads a file outside the project root.

#vulnerability-research#web-security#access-control#exploit-development

Root Cause AnalysisSep 24, 20269 min read

CVE-2026-91117: Uncaught ValueError on a NUL Byte in ServeStatic

Why a NUL byte that survives ServeStatic's path normalization makes its containment check raise an uncaught ValueError, so the request returns a 500 and, with Django DEBUG enabled, the technical error page.

#web-security#vulnerability-research#exploit-development