Security vulnerability disclosures by idisdi.
- IDs (
IDI-YYYY-NNNN) are internal tracking numbers. Not all analyses result in a report — false positives and self-rejected cases are excluded and will not be published.
| ID | Target | Reported Via | Status |
|---|---|---|---|
| IDI-2026-0001 | fastavro · Unbounded Array Block-Count Amplification DoS | Author | Submitted |
| IDI-2026-0005 | js-yaml · Merge Key Chain Quadratic DoS (incomplete fix for CVE-2026-53550) | GitHub | Submitted |
| IDI-2026-0013 | exceljs · xlsx Zip Bomb — Unbounded DEFLATE Decompression DoS | Author | Submitted |
| IDI-2026-0014 | python-docx · docx Zip Bomb — Unbounded DEFLATE Decompression DoS | Author | Submitted |
| IDI-2026-0015 | openpyxl · xlsx Zip Bomb — Unbounded DEFLATE Decompression DoS | Author | Submitted |
| IDI-2026-0016 | simple-git · Argument-injection guard bypass via Git long-option abbreviation leading to command execution | GitHub | Submitted |
| CVE-2026-71870 Moderate IDI-2026-0017 |
pypdf · ToUnicode CMap unbounded recursion / memory exhaustion DoS | GitHub | Published |
| IDI-2026-0028 | ujson · Decoder out-of-bounds read on non-NUL-terminated buffer inputs | GitHub PVRT | Submitted |
- Reports that were rejected by CNAs or maintainers. Published as learning records — not vulnerability claims.
| ID | Target | Reported Via | Status |
|---|---|---|---|
| none yet |
idisdi-cve-vault/
├── candidates/ # Per-package CVE hunting workspace — search → analyze → review → DA (local only)
├── reports/ # Finished vulnerability reports (published ones tracked here)
├── scripts/ # Management scripts — tracker.py, etc. (local only)
├── poc_run/ # PoC execution scratch space (local only)
└── .claude/ # Pipeline rules and skill definitions (local only)
├── agents/ # Subagent definitions
│ └── da.md # Devil's Advocate — adversarially reviews GO-tagged findings
├── refs/ # Detailed per-stage rules (search/analyze/review/report/poc)
└── skills/ # Slash-command skill implementations
├── search/ # Auto-discovers CVE targets matching priority criteria
├── analyze/ # 3-stage lens analysis: Sink Discovery → Reachability → Exploitability
├── review/ # Verifies report-worthiness, assigns GO/STOP tags
├── report/ # Generates vulnerability reports (internal/MITRE/GitHub/Email/Tidelift)
├── submit/ # Updates README's Reported Via/Status after submission
├── published/ # Publishes a report once its advisory goes public
├── tracker/ # Adds/updates analysis results in tracker.db
└── hunt/ # Orchestrates the full search→analyze→review→DA→report pipeline
For questions about these disclosures, contact hihjlee0505@gmail.com.