/
attack_type:arbitrary_file_write × victim_sectors:technology × criticity:high × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · high

VS Code Copilot Chat applyPatchTool TOCTOU bypass lets prompt injection write arbitrary files and achieve RCE, exfiltrating GITHUB_TOKEN

Researcher ahacker1, using the Hacktron AI tooling, disclosed a bypass of earlier fixes for prompt-injection-to-RCE in VS Code Copilot Chat agent mode. A TOCTOU flaw in the applyPatchTool component lets a crafted prompt write files outside the workspace without user confirmation. The attack can be triggered by pasting a prompt into Copilo…

technology
hacktron.ai · high

Google Antigravity IDE browser extension flaw enables arbitrary file write and RCE via SaveScreenRecording path traversal ($10,000 bounty)

Hacktron researcher sudi disclosed a vulnerability in the browser extension bundled with Google's AI IDE Antigravity, which is built on the same internals as Windsurf. The extension's externallyconnectable setting allows any web page to send messages to it. The SaveScreenRecording action forwards attacker-controlled filename and L fields …

technology software development