Skip to content

README.md

Latest commit

 

History

History
53 lines (42 loc) · 3.19 KB

README.md

File metadata and controls

53 lines (42 loc) · 3.19 KB
Raw

idisdi Public Disclosures

Security vulnerability disclosures by idisdi.

Disclosures

  • IDs (IDI-YYYY-NNNN) are internal tracking numbers. Not all analyses result in a report — false positives and self-rejected cases are excluded and will not be published.
ID Target Reported Via Status
IDI-2026-0001 fastavro · Unbounded Array Block-Count Amplification DoS Author Submitted
IDI-2026-0005 js-yaml · Merge Key Chain Quadratic DoS (incomplete fix for CVE-2026-53550) GitHub Submitted
IDI-2026-0013 exceljs · xlsx Zip Bomb — Unbounded DEFLATE Decompression DoS Author Submitted
IDI-2026-0014 python-docx · docx Zip Bomb — Unbounded DEFLATE Decompression DoS Author Submitted
IDI-2026-0015 openpyxl · xlsx Zip Bomb — Unbounded DEFLATE Decompression DoS Author Submitted
IDI-2026-0016 simple-git · Argument-injection guard bypass via Git long-option abbreviation leading to command execution GitHub Submitted
CVE-2026-71870
Moderate
IDI-2026-0017		 pypdf · ToUnicode CMap unbounded recursion / memory exhaustion DoS GitHub Published
IDI-2026-0028 ujson · Decoder out-of-bounds read on non-NUL-terminated buffer inputs GitHub PVRT Submitted

Lesson Learned

  • Reports that were rejected by CNAs or maintainers. Published as learning records — not vulnerability claims.
ID Target Reported Via Status
none yet

Repo Structure

idisdi-cve-vault/
├── candidates/     # Per-package CVE hunting workspace — search → analyze → review → DA (local only)
├── reports/        # Finished vulnerability reports (published ones tracked here)
├── scripts/        # Management scripts — tracker.py, etc. (local only)
├── poc_run/        # PoC execution scratch space (local only)
└── .claude/        # Pipeline rules and skill definitions (local only)
    ├── agents/         # Subagent definitions
    │   └── da.md       # Devil's Advocate — adversarially reviews GO-tagged findings
    ├── refs/           # Detailed per-stage rules (search/analyze/review/report/poc)
    └── skills/         # Slash-command skill implementations
        ├── search/     # Auto-discovers CVE targets matching priority criteria
        ├── analyze/    # 3-stage lens analysis: Sink Discovery → Reachability → Exploitability
        ├── review/     # Verifies report-worthiness, assigns GO/STOP tags
        ├── report/     # Generates vulnerability reports (internal/MITRE/GitHub/Email/Tidelift)
        ├── submit/     # Updates README's Reported Via/Status after submission
        ├── published/  # Publishes a report once its advisory goes public
        ├── tracker/    # Adds/updates analysis results in tracker.db
        └── hunt/       # Orchestrates the full search→analyze→review→DA→report pipeline

Contact

For questions about these disclosures, contact hihjlee0505@gmail.com.