https://poc.intelseclab.com/tags/supply-chain/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-08-09_cve-2026-18718-ghidra-swift-demangler-code-execution/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-08-09_cve-2026-18718-ghidra-swift-demangler-code-execution/High severity (CVSS 7.5) — misc · CVE-2026-18718. Status: Patched. Affects: Ghidra (NSA reverse engineering framework), Swift Demangler analyzer. Tags: ghidra, nsa, reverse-engineering, swift, demangler, code-execution, project-file, analyzer, CWE-427, CWE-494, uncontrolled-search-path, supply-chain, research-tool, shared-project.miscHighghidransareverse-engineeringswiftdemanglercode-executionproject-fileanalyzerCWE-427CWE-494uncontrolled-search-pathsupply-chainresearch-toolshared-projecthttps://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-54416-tj-actions-branch-names-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-54416-tj-actions-branch-names-command-injection/Critical severity (CVSS 9.1) — cloud · CVE-2025-54416. Status: PoC. Affects: tj-actions/branch-names GitHub Action. Tags: github-actions, ci-cd, command-injection, supply-chain, tj-actions, branch-names, secrets-exfiltration, shell-injection.cloudCriticalgithub-actionsci-cdcommand-injectionsupply-chaintj-actionsbranch-namessecrets-exfiltrationshell-injectionhttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-11417-aws-cdk-rce/High severity (CVSS 3.1) — cloud · CVE-2026-11417. Status: PoC. Affects: aws-cdk-lib (npm package), NodejsFunction L2 construct. Tags: aws, cdk, supply-chain, command-injection, esbuild, nodejs, ci-cd, rce.cloudHighawscdksupply-chaincommand-injectionesbuildnodejsci-cdrcehttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-44590-sherlock-pull-request-target-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-44590-sherlock-pull-request-target-rce/Critical severity (CVSS 9.3) — cloud · CVE-2026-44590. Status: PoC. Affects: sherlock-project/sherlock (GitHub Actions workflow validate_modified_targets.yml). Tags: github-actions, pull_request_target, command-injection, ci-cd, supply-chain, token-exfiltration, sherlock.cloudCriticalgithub-actionspull_request_targetcommand-injectionci-cdsupply-chaintoken-exfiltrationsherlockhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-31900-psf-black-action-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-31900-psf-black-action-rce/High severity (CVSS 8.7) — misc · CVE-2026-31900 (GHSA-v53h-f6m7-xcgm). Status: PoC. Affects: psf/black GitHub Action. Tags: github-actions, supply-chain, rce, regex, pep508, ci-cd, secrets-theft, psf-black.miscHighgithub-actionssupply-chainrceregexpep508ci-cdsecrets-theftpsf-blackhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5366-prefect-git-argument-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5366-prefect-git-argument-injection/High severity — web · CVE-2026-5366 (Huntr bounty e2e88a0f-a8f6-49c9-94c5-e98dc385f07a). Status: PoC. Affects: Prefect (workflow orchestration platform), GitRepository storage class. Tags: prefect, git, argument-injection, rce, upload-pack, workflow-orchestration, supply-chain, python.webHighprefectgitargument-injectionrceupload-packworkflow-orchestrationsupply-chainpythonhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/High severity — misc · CVE-2026-23947. Status: PoC. Affects: Orval (OpenAPI-to-TypeScript client generator), version 7.10.0. Tags: orval, openapi, code-generation, arbitrary-code-execution, nodejs, supply-chain, typescript, build-tooling.miscHighorvalopenapicode-generationarbitrary-code-executionnodejssupply-chaintypescriptbuild-toolinghttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/High severity — misc · CVE-2026-29786. Status: PoC. Affects: tar npm package (Node.js). Tags: node-tar, path-traversal, symlink, archive-extraction, arbitrary-file-write, nodejs, supply-chain.miscHighnode-tarpath-traversalsymlinkarchive-extractionarbitrary-file-writenodejssupply-chainhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/High severity — misc · CVE-2026-23745 / GHSA-8qq5-rm4j-mr97. Status: PoC. Affects: node-tar (npm package tar). Tags: node-tar, path-traversal, arbitrary-file-overwrite, hardlink, symlink, supply-chain, nodejs, tar-archive.miscHighnode-tarpath-traversalarbitrary-file-overwritehardlinksymlinksupply-chainnodejstar-archivehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33671-nextjs-vendored-picomatch-dep/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33671-nextjs-vendored-picomatch-dep/High severity — web · CVE-2026-33671. Status: PoC. Affects: Next.js 16.2.4 (bundles picomatch 4.0.3 at node_modules/next/dist/compiled/picomatch/). Tags: nextjs, picomatch, vendored-dependency, supply-chain, sca-bypass, trivy, nodejs, dependency-scanning.webHighnextjspicomatchvendored-dependencysupply-chainsca-bypasstrivynodejsdependency-scanninghttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-4660-go-getter-terraform-pathspec-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-4660-go-getter-terraform-pathspec-injection/High severity (CVSS 7.5) — cloud · CVE-2026-4660 / HCSEC-2026-04. Status: PoC. Affects: hashicorp/go-getter (used by Terraform, Nomad, Packer, Waypoint). Tags: terraform, go-getter, git, pathspec-injection, arbitrary-file-read, ci-cd, supply-chain, iac.cloudHighterraformgo-gettergitpathspec-injectionarbitrary-file-readci-cdsupply-chainiachttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-22807-vllm-trust-remote-code-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-22807-vllm-trust-remote-code-bypass/High severity — misc · CVE-2026-22807. Status: PoC. Affects: AI inference/model-loading frameworks that resolve custom model classes via auto_map before validating trust_remote_code (pattern seen in vLLM/Transformers-style loaders). Tags: vllm, huggingface, trust-remote-code, toctou, model-loading, supply-chain, python, code-execution.miscHighvllmhuggingfacetrust-remote-codetoctoumodel-loadingsupply-chainpythoncode-execution