Discovered Vulnerabilities

Command injection in the Microsoft Foundry Toolkit VS Code extension (formerly AI Toolkit) where child_process.exec() interpolated an attacker-controlled Python interpreter path — sourced from python.defaultInterpreterPath in workspace settings — directly into a shell command string. On Linux/macOS, double-quoting the path enabled POSIX command substitution, allowing arbitrary code execution when a developer opened a malicious repository. No CVE was assigned; Microsoft cited automatic extension updates and limited user impact. Fixed in version 0.32.0.

IDOR in Retrieval API (CVE-2026-45398): _validate_collection_access() only checked user-memory-* and file-* prefixes, leaving knowledge base UUID collections unguarded — any authenticated user could read, corrupt, or destroy another user's private knowledge base.

SSRF via HTTP Redirect Following (CVE-2026-45401): validate_url() checked only the initial URL but downstream HTTP clients followed 3xx redirects without re-validation, allowing any authenticated user to reach internal services via the web-fetch, image-load, and chat-completion endpoints.

Both fixed in Open WebUI 0.9.5.

SQL injection in Spring AI's vector store implementations, where filter expression output was concatenated directly into SQL statements without parameterization. Affected PgVectorStore, OracleVectorStore, and CouchbaseSearchVectorStore, allowing attackers to bypass tenant isolation, exfiltrate data, and delete arbitrary records. Fixed in Spring AI 1.0.6 and 1.1.5.

Discovered 18 vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) including multiple stack and heap buffer overflows for remote code execution, admin password hash extraction, plaintext credential leakage, stored and reflected XSS, and arbitrary file disclosure. Co-researched with Alex Weber.

Found 6 vulnerabilities in ASUSTOR NAS devices running ADM 3.1.5 and below. Authenticated file upload leading to remote code execution, arbitrary file deletion via path traversal, account enumeration, file disclosure for both user and admin roles, and a man-in-the-middle XSS via update checks.

Local privilege escalation to root in IBM Netezza Platform Software. A setuid root binary executed a Perl script from a world-writable directory, allowing unprivileged users to inject code and gain root access.

Authenticated RCE in Firebird database server. By declaring external user-defined functions with incompatible parameter types, an attacker could overwrite function pointers and achieve SYSTEM-level code execution.