Codex command approval relied on inconsistent parser semantics
ZDI awarded Compass Security USD 40,000 for this distinct Pwn2Own Berlin entry.
USD 40,000competition awardRead
INVulnerability family
Injection and untrusted input.
Separation between untrusted data and executable interpretation. 12 disclosures · 8 related references · 3 diagrams.
Connected collection
Disclosures
PostgreSQL text-encoding invariant failure caused memory corruption
A PostgreSQL encoding-validation failure earned Team Bugz Bunnies a $30,000 individual-entry award at ZeroDay.cloud. The vendor subsequently issued CVE-2026-2006.
USD 30,000competition awardRead
Angular automation trust and cache isolation weakness
A Google-rewarded report connected an adjacent CI misconfiguration with insufficient separation of automation trust, creating a potential Angular supply-chain impact.
USD 31,337reported awardRead
Kestrel HTTP framing differed across proxy and application boundaries
A Kestrel request-framing report earned a researcher-reported USD 10,000 award.
USD 10,000reported awardRead
Gemini-to-Colab rendering boundary exposed Workspace data
Google awarded USD 20,000 for the Colab-export finding in a multi-finding research article.
USD 20,000reported awardRead
GitHub package-source trust allowed dependency confusion
A researcher reported one dependency-confusion finding affecting GitHub build and development services and a $20,000 award.
USD 20,000reported awardRead
NVIDIA container initialization inherited untrusted execution context
ZDI awarded Wiz researchers USD 30,000 for this single Pwn2Own Berlin 2025 entry.
USD 30,000competition awardRead
Google IDX worker messaging crossed browser trust boundaries
A browser-IDE trust-boundary report received a USD 22,500 award.
USD 22,500reported awardRead
Bard Workspace integration weakened output-data boundaries
One Workspace data-disclosure finding within a broader research article earned USD 20,000.
USD 20,000reported awardRead
Meta Conversions API Gateway trusted message origins as script authority
The researcher assigns a separate $62,500 award to the client-side finding labeled Bug #1.
USD 62,500reported awardRead
Meta Conversions API Gateway mixed configuration data with executable output
The researcher attributes a USD 250,000 award to the article’s separately identified backend finding, Bug #2.
USD 250,000reported awardRead
Facebook SDK message authentication relied on insecure randomness
A USD 66,000 researcher-reported award illustrates how weak message authentication and unsafe rendering can invalidate an SDK trust boundary.
USD 66,000reported awardRead
Connected collection
Related learning
Django: ORM alias metadata must not acquire query authority
Django confirms CVE-2026-1312: application-controlled column aliases could cross from metadata into SQL structure when used across relation filtering and ordering. Exploitability requires an application to admit…
Reviewed 2026-10-03Read
Next.js: response metadata must preserve representation boundaries
Researchers describe client-supplied metadata becoming authoritative response metadata through unusual middleware header copying. This changed how a dynamic App Router representation was interpreted; an external shared…
Reviewed 2026-10-04Read
Authorization Cheat Sheet
Practical design guidance covering least privilege, deny-by-default behavior, consistent per-request decisions, failure handling, logging, and authorization regression tests.
Reviewed 2026-10-02Read
HTML5 Security Cheat Sheet: Web Messaging
OWASP explains origin checks, expected message formats and treating exchanged content as data. These controls address different assumptions at browser communication boundaries.
Reviewed 2026-10-02Read
LLM Prompt Injection Prevention Cheat Sheet
Defense-in-depth guidance for LLM applications that consume untrusted content or invoke tools. Covers data provenance, least privilege, action authorization, monitoring, and the limitations of guardrails.
Reviewed 2026-10-02Read
Python subprocess: executable, argument, and interpreter boundaries
Runtime documentation distinguishes the selected executable, its arguments, and shell interpretation. Python does not implicitly select a shell, but Windows may launch batch files through one. The companion shlex…
Reviewed 2026-10-03Read
Serialize JavaScript: every serialized field must retain data semantics
The maintainer describes inconsistent escaping across structured-object serialization: some object-derived strings entered generated JavaScript without equivalent protection. Code execution requires attacker-influenced…
Reviewed 2026-10-03Read
SLSA v1.2: supply-chain security and build provenance
Learn to assess software supply-chain assurance using distinct source and build tracks. The build track progresses from recording provenance to authenticated hosted builds and stronger platform isolation. Build…
Reviewed 2026-10-02Read
Connected collection
Visual models
Retrieved content is data, not authority
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Browser messages need separate trust checks
Original defensive model combining OWASP messaging and authorization guidance with the linked historical cases. These are independent design checks, not a vendor patch diagram or an operational reproduction.
Reviewed 2026-10-02Read
Build evidence must match the artifact and trusted builder
Editorial conceptual model combining the Angular case with SLSA build guidance. The case supports separating automation trust and shared build state; the consumer verification gate is a general design synthesis, not a…
Reviewed 2026-10-03Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software