[ top 10 most noteworthy of 56 repo events in this week // 7d ]
The repo wire this week is dominated by inert exploit oracles and negative-day tooling: xssdoctor shipped both a loopback protocol-v2 harness proving git clients swallow an unsafe unborn HEAD symref and a partial-archive fixture tied to CVE-2024-32004, while vitorfhc's videt formalizes the hunt for silent security patches landing before CVEs. Meanwhile renniepak fixed CSPBypass's matcher for scheme-relative directives and multiple headers, and Google's gwpsan untangled seccomp and CFI coexistence -- the exact machinery you'd want when grooming production binaries for the race-condition bugs filling this week's advisories.
xssdoctor/git-cve-2026-113408-poc -- Python harness spinning a loopback-only smart HTTP fixture that feeds a git client an unsafe unborn HEAD symref over protocol-v2, demonstrating branch-update resolution escaping the .git directory (symref -> path escape outside .git). Clean, inert oracle you can run locally in five minutes.
xssdoctor/muse-git-local-partial-archive-20261113 -- Inert local partial-repo fixture tied to CVE-2024-32004; its config carries a promisor upload-pack command that writes a fixed marker only, confirming code execution without touching the network. Textbook controlled reproduction of the partial-clone config-injection class.
vitorfhc/videt -- Python watcher that flags silent security patches in major OSS repos during the negative-day window between commit and CVE assignment, then checks whether the fix is actually reachable. Point it at your dependency tree and let it diff the quiet fixes for you.
renniepak/CSPBypass -- CSPBypass.com's latest push fixes the CSP matcher to handle scheme-relative URLs and multiple directives -- directly relevant to Kettle's 'Blind trust' research, since a broken matcher means missed allowlist gadgets on real prod policies.
google/gwpsan -- Google's sampling-based sanitizer for production binaries restructured its seccomp incompatibility check and exempted GWPSan interceptors from CFI so both coexist in one build -- the tooling you want running when you chase heap races like the mod_http2 and MongoDB bugs in this week's briefs.
google/security-research is the advisory + PoC drop for bugs found in non-Google code; new commits land a CVE-2026-98164 kvmCTF host-crash exploit plus kernelCTF writeups for CVE-2026-80521_lts and CVE-2025-40214_lts_cos.
A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
CSPBypass.com is a tool helping ethical hackers bypass restrictive Content Security Policies and exploit XSS on sites whose CSPs only whitelist certain domains. The latest update fixes the CSP matcher to handle scheme-relative and multiple directives.
videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
An inert local partial-repository fixture for authorized testing of Git's partial-clone behavior, tied to CVE-2024-32004. Its config contains a promisor upload-pack command that only writes a fixed marker, confirming code execution.
Nexus Shield is a TypeScript plugin for the Nexus GraphQL schema platform that eases building authorization layers and permission rules. The recent push adds a check for missing context and documents that requirement.
OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
source: Michael Cote & Darby Hopkins (@google) | role: Guests (Pinned Security Repo) | published: 2026-11-13 13:31 UTC
[ notes ] google/security-research is the advisory + PoC drop for bugs found in non-Google code; new commits land a CVE-2026-98164 kvmCTF host-crash exploit plus kernelCTF writeups for CVE-2026-80521_lts and CVE-2025-40214_lts_cos.
[ source excerpt ] About google/security-research: This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.. Recent commits: Add CVE-2026-98164 kvmCTF host-crash exploit (#440) | kernelCTF: add CVE-2026-80521_lts (#431) | Add kernelCTF CVE-2025-40214_lts_cos (#347)
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 12:46 UTC
[ notes ] A new Python PoC harness for CVE-2026-113408, using a loopback-only smart HTTP fixture to test how a Git client accepts an unsafe unborn HEAD symref from a protocol-v2 server. It demonstrates branch-update resolution escaping the .git directory.
[ source excerpt ] Newly created repository.README: # CVE-2026-113408 bounded Git PoC This repository contains a loopback-only smart HTTP fixture for testing CVE-2026-113408: a Git client can accept an unsafe unborn `HEAD` symref from a protocol-v2 server and later resolve the first branch update outside `.git`. The harness creates one empty bare repository and changes only the unborn HEAD target in the server's `ls-refs` response: ```text refs/heads/../../../../CVE_2026_113408_MARKER.txt ``` The first commit in a vulnerable clone can therefore write the new commit ID to the fixed marker in the clone's dedicated parent. ## Important GitHub limitation GitHub hosts this source and reproduction h...
[ notes ] Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
[ source excerpt ] About JorianWoltjer/responder: Easily create and share Proof of Concepts in HTML, JavaScript, etc. with custom headers, all via query parameters. Recent commits: Support nested autocomplete in SVG/XML | Fix autocomplete error & add langauge shortcut | Fix scrolling on smaller screens
source: Rene de Sain (@renniepak) | role: Guest | published: 2026-11-12 15:01 UTC
[ notes ] CSPBypass.com is a tool helping ethical hackers bypass restrictive Content Security Policies and exploit XSS on sites whose CSPs only whitelist certain domains. The latest update fixes the CSP matcher to handle scheme-relative and multiple directives.
[ source excerpt ] About renniepak/CSPBypass: CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.. Recent commits: Merge pull request #53 from edoardottt/main | replace spaces with tabs | fix CSP matcher to handle scheme-relative and multiple src URLs
[ notes ] videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-13 03:20 UTC
[ notes ] An inert local partial-repository fixture for authorized testing of Git's partial-clone behavior, tied to CVE-2024-32004. Its config contains a promisor upload-pack command that only writes a fixed marker, confirming code execution.
[ source excerpt ] Repo description: Inert local partial-repository archive for authorized Muse Git testing. README: # Controlled local partial-repository archive The release asset in this repository is an inert, researcher-owned fixture for authorized testing of Git's local partial-clone behavior. Its local Git config contains one promisor upload-pack command that writes only the fixed text `MUSE_GIT_CVE_2024_32004_FIRED` into its own `.git` directory and exits. It performs no reads, network callbacks, persistence, or writes outside the extracted fixture directory.
source: Daniel Miessler (@danielmiessler) | role: Guest | published: 2026-11-13 02:45 UTC
[ notes ] Fabric is a Go modular text-workflow framework with reusable command patterns for recon/reporting; v1.4.571 adds a Synap-compatible endpoint adapter.
[ source excerpt ] About danielmiessler/Fabric: Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.. Release v1.4.571: ## Changes ### PR [#2342](https://github.com/danielmiessler/Fabric/pull/2342) by [weare-linkrra](https://github.com/weare-linkrra): feat(providers): add Synap as an OpenAI-compatible provider - Added Synap as an OpenAI-compatible provider, including a new ProviderMap entry with the base URL `https://synap402.com/v1` and authentication via the `SYNAP_API_KEY` environment variable. - Added a `TestCreateClient` test case covering the new Synap provider. - Updated the README provider lists (English, Chinese, Arabic) to document Synap.
[ notes ] Nexus Shield is a TypeScript plugin for the Nexus GraphQL schema platform that eases building authorization layers and permission rules. The recent push adds a check for missing context and documents that requirement.
[ source excerpt ] About Sytten/nexus-shield: 🛡 Nexus plugin to ease the creation of the authorization layer. Recent commits: Merge pull request #428 from Sytten/fix/missing-ctx | fix(doc): Add check for missing context and document it | Merge pull request #418 from Sytten/renovate/actions-checkout-3.x
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 18:51 UTC
[ notes ] OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
[ source excerpt ] About google/osv.dev: Open source vulnerability DB and triage service.. Recent commits: chore(infra): migrate oss-vdb-test Cloud Run to least-privilege osv-frontend SA (#6356) | fix: order TuxCare CentOS, CentOS-Stream, OracleLinux and RHEL versions as RPM (#6357) | fix: goose interacting with pooled sql connections (#6361)