~/research
research
pt-br ↗I like following bugs across layers. Here are a few of those investigations.
selected research
2026VectorFreed
from SVG parsing to code execution.
A librsvg use-after-free, with RCE confirmed across multiple applications.
writeups
all posts ↗Redirect2Admin: Exploiting an SSRF chain to leak internal keys and take over GitHub Enterprise Server
How a requirements check, authentication between services, and two Protobuf messages ended up exposing admin access to GHES.
read the writeup ↗CVE-2026-75604Next.js: From Path Traversal to RCE on Windows Servers
Next.js published CVE-2026-75604 for a flaw in FileSystemCache on self-hosted Windows servers.
read the writeup ↗CVEs
7 public recordsPublished advisories for bugs I reported. Related paths stay together.
VectorFreed ↗
librsvg · Next.js · Ghost
- CVE-2026-96889librsvg / Next.js
SVG use-after-free & Image Optimization RCE
Next.js advisory ↗ - CVE-2026-94545Next.js
ImageResponse RCE
- CVE-2026-105642Ghost
RCE through bookmark card images
Request boundaries
Next.js · SvelteKit
- CVE-2026-82258SvelteKit
Cross-user data disclosure in query.batch
- CVE-2026-64648Next.js
Response body cache confusion
GitLab
SCIM · project labels
- CVE-2025-10903GitLab
Unbounded loop in SCIM user provisioning
- CVE-2026-1282GitLab
HTML injection in project label titles
citations
VectorFreedReporting and technical analysis that reference the research.
- The Hacker NewscoverageNext.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
- INCIBE-CERTsecurity alertEjecución remota de código en Next.js de Vercel
- BrandefenseanalysisCVE-2026-96889 — Next.js Image RCE Explained
- OstorlabanalysisUnauthenticated RCE in Next.js Image Optimization