5 RCEs in npm for $15,000

I found and reported these vulnerabilities with @ginkoid. In this post, I will discuss the root cause of these vulnerabilities, as well as briefly walk through the exploitation process. I’ll also include some thoughts about bug bounty in general at the end. These are the associated CVEs and payouts: CVE-2021-32804 ($10,000)CVE-2021-32803 ($2,000)CVE-2021-37701 ($2,500)CVE-2021-37712 (found interna

[efcl]

npm arboristとtarの脆弱性についての解説。 path周りの処理、WindowsでのパスのisAbsoluteの難しさ、シンボリックリンクとキャッシュディレクトリの不整合の難しさについて

[jay-es]

npm にも使われている node-tar の脆弱性を発見した話