https://poc.intelseclab.com/tags/nodejs/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Critical severity (CVSS 10) — web · CVE-2025-55182. Status: PoC. Affects: React Server Components (RSC) packages using the Flight protocol (commonly deployed via Next.js). Tags: react, react-server-components, rsc, flight-protocol, prototype-pollution, deserialization, unauthenticated-rce, nextjs, nodejs, python.webCriticalreactreact-server-componentsrscflight-protocolprototype-pollutiondeserializationunauthenticated-rcenextjsnodejspythonhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-23061-mongoose-command-injection/Critical severity (CVSS 9) — web · CVE-2025-23061. Status: Weaponized. Affects: Mongoose (Node.js MongoDB ODM). Tags: mongoose, nodejs, nosql-injection, mongodb, populate, where-operator, command-injection, rce, cwe-943, cwe-94, express.webCriticalmongoosenodejsnosql-injectionmongodbpopulatewhere-operatorcommand-injectionrcecwe-943cwe-94expresshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27778-websocket-auth-bruteforce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27778-websocket-auth-bruteforce/Medium severity — web · CVE-2026-27778. Status: PoC. Affects: Generic Node.js/Express + ws WebSocket authentication server (demonstration/simulator app). Tags: websocket, brute-force, cwe-307, rate-limiting, authentication, nodejs, simulator.webMediumwebsocketbrute-forcecwe-307rate-limitingauthenticationnodejssimulatorhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/High severity (CVSS 3.1) — cloud · CVE-2026-11417. Status: PoC. Affects: aws-cdk-lib (npm package), NodejsFunction L2 construct. Tags: aws, cdk, supply-chain, command-injection, esbuild, nodejs, ci-cd, rce.cloudHighawscdksupply-chaincommand-injectionesbuildnodejsci-cdrcehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/High severity — web · CVE-2026-30951. Status: PoC. Affects: Sequelize ORM v6 (Node.js). Tags: sequelize, sqli, orm, json-cast, nodejs, express, sqlite, boolean-based.webHighsequelizesqliormjson-castnodejsexpresssqliteboolean-basedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40487-postiz-svg-upload-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40487-postiz-svg-upload-xss/High severity (CVSS 8.9) — web · CVE-2026-40487 / GHSA-44wg-r34q-hvfx. Status: PoC. Affects: Postiz (open-source social media management platform, gitroomhq/postiz-app). Tags: file-upload, mime-spoofing, stored-xss, account-takeover, postiz, nodejs, oauth-backdoor.webHighfile-uploadmime-spoofingstored-xssaccount-takeoverpostiznodejsoauth-backdoorhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25126-polarlearn-vote-manipulation/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25126-polarlearn-vote-manipulation/Medium severity — web · CVE-2026-25126. Status: PoC. Affects: PolarLearn forum platform. Tags: business-logic, vote-manipulation, input-validation, api-abuse, forum, nodejs, ghost-downvote.webMediumbusiness-logicvote-manipulationinput-validationapi-abuseforumnodejsghost-downvotehttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/High severity — misc · CVE-2026-23947. Status: PoC. Affects: Orval (OpenAPI-to-TypeScript client generator), version 7.10.0. Tags: orval, openapi, code-generation, arbitrary-code-execution, nodejs, supply-chain, typescript, build-tooling.miscHighorvalopenapicode-generationarbitrary-code-executionnodejssupply-chaintypescriptbuild-toolinghttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/High severity — web · CVE-2026-33331 (GHSA-7f6v-3gx7-27q8). Status: PoC. Affects: middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts). Tags: xss, stored-xss, orpc, openapi, cwe-79, javascript, nodejs, docs-page.webHighxssstored-xssorpcopenapicwe-79javascriptnodejsdocs-pagehttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-2395-tar-race-condition/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-2395-tar-race-condition/Medium severity — misc · CVE-2026-2395. Status: PoC. Affects: tar npm package. Tags: tar, nodejs, npm, race-condition, unicode-normalization, file-collision, archive-extraction, data-corruption.miscMediumtarnodejsnpmrace-conditionunicode-normalizationfile-collisionarchive-extractiondata-corruptionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41242-protobufjs-rce/Critical severity — web · CVE-2026-41242. Status: PoC. Affects: Node.js application using protobufjs (Root.fromJSON + dynamic decode). Tags: nodejs, protobufjs, rce, deserialization, express, code-injection, javascript.webCriticalnodejsprotobufjsrcedeserializationexpresscode-injectionjavascripthttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/High severity — misc · CVE-2026-29786. Status: PoC. Affects: tar npm package (Node.js). Tags: node-tar, path-traversal, symlink, archive-extraction, arbitrary-file-write, nodejs, supply-chain.miscHighnode-tarpath-traversalsymlinkarchive-extractionarbitrary-file-writenodejssupply-chainhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/High severity — misc · CVE-2026-23745 / GHSA-8qq5-rm4j-mr97. Status: PoC. Affects: node-tar (npm package tar). Tags: node-tar, path-traversal, arbitrary-file-overwrite, hardlink, symlink, supply-chain, nodejs, tar-archive.miscHighnode-tarpath-traversalarbitrary-file-overwritehardlinksymlinksupply-chainnodejstar-archivehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33671-nextjs-vendored-picomatch-dep/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33671-nextjs-vendored-picomatch-dep/High severity — web · CVE-2026-33671. Status: PoC. Affects: Next.js 16.2.4 (bundles picomatch 4.0.3 at node_modules/next/dist/compiled/picomatch/). Tags: nextjs, picomatch, vendored-dependency, supply-chain, sca-bypass, trivy, nodejs, dependency-scanning.webHighnextjspicomatchvendored-dependencysupply-chainsca-bypasstrivynodejsdependency-scanninghttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-8161-multiparty-prototype-pollution-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-8161-multiparty-prototype-pollution-dos/Medium severity — misc · CVE-2026-8161 / GHSA-qxch-whhj-8956. Status: PoC. Affects: multiparty (npm package, multipart/form-data parser). Tags: multiparty, nodejs, prototype-pollution, denial-of-service, cwe-1321, uncaught-exception, multipart-parser.miscMediummultipartynodejsprototype-pollutiondenial-of-servicecwe-1321uncaught-exceptionmultipart-parserhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3304-multer-orphaned-file-dos/High severity (CVSS 8.7) — web · CVE-2026-3304. Status: PoC. Affects: Multer (Node.js multipart/form-data middleware for Express). Tags: multer, nodejs, express, dos, file-upload, orphaned-file, disk-exhaustion, multipart.webHighmulternodejsexpressdosfile-uploadorphaned-filedisk-exhaustionmultiparthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34220-mikroorm-sql-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34220-mikroorm-sql-injection/High severity — web · CVE-2026-34220. Status: PoC. Affects: MikroORM (Node.js/TypeScript ORM). Tags: sql-injection, mikroorm, nodejs, typescript, orm, docker, database.webHighsql-injectionmikroormnodejstypescriptormdockerdatabasehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40897-mathjs-sandbox-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40897-mathjs-sandbox-bypass-rce/Critical severity — web · CVE-2026-40897. Status: Weaponized. Affects: Math.js expression parser (Node.js library). Tags: mathjs, nodejs, sandbox-bypass, rce, expression-parser, prototype-pollution-adjacent, reverse-shell, javascript.webCriticalmathjsnodejssandbox-bypassrceexpression-parserprototype-pollution-adjacentreverse-shelljavascripthttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-30952-liquidjs-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-30952-liquidjs-path-traversal/High severity (CVSS 8.7) — misc · CVE-2026-30952 (GHSA-wmfp-5q7x-987x). Status: PoC. Affects: liquidjs npm package (LiquidJS template engine). Tags: liquidjs, path-traversal, template-engine, arbitrary-file-read, nodejs, library, ssti-adjacent.miscHighliquidjspath-traversaltemplate-enginearbitrary-file-readnodejslibraryssti-adjacenthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46395-haxcms-hmac-key-leak/Critical severity (CVSS 9.8) — web · CVE-2026-46395. Status: PoC. Affects: HAXcms Node.js backend (elmsln/HAXcms, haxcms-nodejs) — src/lib/HAXCMS.js. Tags: haxcms, nodejs, hmac, jwt-forgery, cwe-321, cwe-200, key-disclosure, cms.webCriticalhaxcmsnodejshmacjwt-forgerycwe-321cwe-200key-disclosurecmshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33937-handlebars-ast-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33937-handlebars-ast-rce/Critical severity — web · CVE-2026-33937. Status: PoC. Affects: Handlebars (Node.js templating engine). Tags: handlebars, rce, template-injection, ast-injection, nodejs, express, javascript-compiler, code-generation.webCriticalhandlebarsrcetemplate-injectionast-injectionnodejsexpressjavascript-compilercode-generationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29053-ghost-cms-jsonpath-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29053-ghost-cms-jsonpath-rce/High severity — web · CVE-2026-29053 (GHSA-cgc2-rcrh-qr5x). Status: PoC. Affects: Ghost CMS. Tags: ghost-cms, rce, jsonpath, static-eval, handlebars, theme-upload, prototype-pollution, nodejs.webHighghost-cmsrcejsonpathstatic-evalhandlebarstheme-uploadprototype-pollutionnodejshttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-43893-exiftool-vendored-arg-injection-file-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-43893-exiftool-vendored-arg-injection-file-write/High severity (CVSS 8.2) — misc · CVE-2026-43893 / GHSA-cw26-7653-2rp5. Status: PoC. Affects: exiftool-vendored (npm package, Node.js wrapper around Phil Harvey's ExifTool). Tags: exiftool, exiftool-vendored, argument-injection, arbitrary-file-write, arbitrary-file-read, nodejs, cli-wrapper, newline-injection.miscHighexiftoolexiftool-vendoredargument-injectionarbitrary-file-writearbitrary-file-readnodejscli-wrappernewline-injectionhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48017-dbgate-loadreader-functionname-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48017-dbgate-loadreader-functionname-rce/High severity (CVSS 8.8) — web · CVE-2026-48017 / GHSA-hv83-ggc4-v385. Status: PoC. Affects: DbGate (dbgate-api), a web-based database management GUI. Tags: dbgate, nodejs, code-injection, rce, cwe-94, authenticated, database-gui.webHighdbgatenodejscode-injectionrcecwe-94authenticateddatabase-guihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21440-adonisjs-bodyparser-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-21440-adonisjs-bodyparser-path-traversal/Critical severity (CVSS 9.2) — web · CVE-2026-21440 (GHSA-gvq6-hvvp-h34h). Status: Weaponized. Affects: @adonisjs/bodyparser (AdonisJS multipart file-upload handling). Tags: adonisjs, nodejs, path-traversal, arbitrary-file-write, cwe-22, file-upload, rce, bodyparser.webCriticaladonisjsnodejspath-traversalarbitrary-file-writecwe-22file-uploadrcebodyparserhttps://poc.intelseclab.com/pocs/web/2026-07-03_nodebb-activitypub-uid-spoof/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_nodebb-activitypub-uid-spoof/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: NodeBB — ActivityPub server-to-server inbox. Tags: nodebb, activitypub, federation, authentication-bypass, spoofing, uid-forgery, forum-software, nodejs.webHighnodebbactivitypubfederationauthentication-bypassspoofinguid-forgeryforum-softwarenodejs