Web application security
Routing, OAuth, token verification, and the difference between technically valid input and an authorized action.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
CVE research 3
CVE-2026-125330: Cross-Workspace Session Access with a HarnessRouter Workspace Key
Root-cause analysis of CVE-2026-125330: HarnessRouter narrowed the session list to an API key's workspace, but the routes that take a session or response id checked only the organization. A workspace key that knew another workspace's session id could read, overwrite, publish and delete that session. Fixed in 0.31.7.
17 min read ↗CVE-2026-112950 · Lab ReproducedCVE-2026-112950: Windows Backslash Traversal in @vitest/mocker
Root-cause analysis of CVE-2026-112950: on Windows, a redirect mock path containing a backslash passes the Vite allowlist check added by the first fix and then reads a file outside the project root.
10 min read ↗CVE-2026-91117 · Lab ReproducedCVE-2026-91117: Uncaught ValueError on a NUL Byte in ServeStatic
Why a NUL byte that survives ServeStatic's path normalization makes its containment check raise an uncaught ValueError, so the request returns a 500 and, with Django DEBUG enabled, the technical error page.
9 min read ↗