Defense is built by those who know how to attack.
Vulnerability research and coordinated disclosures by Dennis Sepede - Co-Founder & CTO of Securitix Solutions. Every finding comes from manual source-code review and a working proof-of-concept, disclosed under a 90-day coordinated policy - with a growing focus on AI/LLM security.
| CVE | Target | Vulnerability | Severity |
|---|---|---|---|
| CVE-2026-118658 | labstack/echo | Arbitrary scheme injection in WWWRedirect/NonWWWRedirect via X-Forwarded-Proto | Medium 4.7 |
| CVE-2026-51088 | Tzahi12345/YoutubeDL-Material | Argument Injection to RCE via customArgs | Critical 9.8 |
| CVE-2026-51089 | LiangYang666/ChatGPT-Web | Pickle deserialization RCE | Critical 9.8 |
| CVE-2026-51090 | ltzheng/agent-studio | jsonpickle deserialization RCE | Critical 9.8 |
| CVE-2026-51091 | develon2015/Youtube-dl-REST | OS Command Injection via recode | Critical 9.8 |
| CVE-2026-51092 | kudlav/videoeditor | OS Command Injection via upload filename | Critical 9.8 |
| CVE-2026-51093 | maxpumperla/elephas | Pickle deserialization RCE | Critical 9.8 |
| CVE-2026-51094 | Tiendil/feeds.fun | Server-Side Request Forgery | High 7.7 |
| CVE-2026-51095 | antmicro/protoplaster | Pickle deserialization RCE | Critical 9.8 |
| CVE-2026-51096 | Tanq16/local-content-share | Path Traversal (read/write/delete) | Critical 9.8 |
| CVE-2026-51097 | stepfun-ai/Step-Video-T2V | Pickle deserialization RCE | Critical 9.8 |
| CVE-2026-51098 | wizsk/goshare | Path Traversal (arbitrary file read) | High 7.5 |
| CVE-2026-40895 | follow-redirects (axios dependency) | Custom auth headers leak on cross-domain redirect | Medium 6.9 |
| CVE-2026-38595 | im3x/Scriptables | OS Command Injection via filename | Critical 9.8 |
| CVE-2026-38600 | gohttpserver | Zip Slip - arbitrary file write → RCE | Critical 9.1 |
| CVE-2026-38601 | gohttpserver | Hardcoded session secret - auth bypass | High 7.5 |
MITRE also issued five duplicate IDs (CVE-2026-51099 to CVE-2026-51103) for vulnerabilities already listed above.
A single bug class - custom authentication headers leaking across cross-origin redirects (CWE-200) - surfaced through manual review across six widely-used HTTP client libraries. These clients strip Authorization, Cookie, Proxy-Authorization and Host on redirect, but forward custom auth headers (X-API-Key, X-Auth-Token, Api-Key, ...) verbatim to the redirect target, leaking credentials to attacker-controlled hosts.
undici · node-fetch · follow-redirects · parnurzeal/gorequest · imroc/req · go-resty/resty
Outcomes span the full spectrum of real-world disclosure: a coordinated GHSA for follow-redirects, an upstream fix in go-resty PR #1136, and spec-compliance pushback from others - each documented per advisory below.
| ID | Target | Vulnerability | Severity | Identifier | Status | Date |
|---|---|---|---|---|---|---|
| VDR-001 | gohttpserver | Zip Slip - Arbitrary File Write | Critical (9.1) | CVE-2026-38600 | No upstream fix (project unmaintained) | 2026-03-19 |
| VDR-002 | gohttpserver | Hardcoded Session Secret - Auth Bypass | High (7.5) | CVE-2026-38601 | No upstream fix (project unmaintained) | 2026-03-19 |
| VDR-003 | im3x/Scriptables | OS Command Injection via Filename | Critical (9.8) | CVE-2026-38595 | No upstream fix (project unmaintained) | 2026-04-14 |
| VDR-004 | nodejs/undici | Custom Auth Headers Leak on Cross-Origin Redirect | Medium | - | Closed by maintainer (not planned) |
2026-03-20 |
| VDR-005 | node-fetch | Custom Auth Headers + proxy-authorization Leak on Cross-Origin Redirect | Medium | Pending | Awaiting maintainer | 2026-03-20 |
| VDR-006 | parnurzeal/gorequest | Custom Auth Headers Leak on Cross-Domain Redirect | High (7.4) | Pending | Awaiting maintainer | 2026-03-20 |
| VDR-007 | imroc/req | Custom Auth Headers Leak on Cross-Domain Redirect | High (7.4) | Pending | Awaiting maintainer | 2026-03-20 |
| VDR-008 | go-resty/resty | Custom Auth Header Leak via SetHeaderAuthorizationKey | Medium | Pending | Fixed in PR #1136 | 2026-03-20 |
| VDR-009 | follow-redirects | Custom Auth Headers Leak (axios dependency) | Medium | GHSA-r4q5-vmmm-2653 | Coordinated disclosure | 2026-03-20 |
| VDR-010 | phpk/godoos | Critical Path Traversal on 14+ unauthenticated endpoints | Critical (9.8) | Pending | Awaiting maintainer | 2026-03-20 |
| VDR-011 | aiohttp | Credentials preserved across HTTP->HTTPS redirect with port change | Medium | - | Fixed on master (PR #12275) |
2026-03-20 |
| VDR-011 | stepfun-ai/Step-Video-T2V | Unauthenticated pickle deserialization RCE | Critical (9.8) | CVE-2026-51097 | Published | 2026-06-05 |
| VDR-013 | local-content-share | Unauthenticated path traversal (read/write/delete) | Critical (9.8) | CVE-2026-51096 | Published | 2026-06-05 |
| VDR-014 | wizsk/goshare | Unauthenticated path traversal (file read) | High (7.5) | CVE-2026-51098 | Published | 2026-06-05 |
| VDR-015 | antmicro/protoplaster | Unauthenticated pickle deserialization RCE | Critical (9.8) | CVE-2026-51095 | Published | 2026-06-05 |
| VDR-016 | kudlav/videoeditor | OS command injection via upload filename | Critical (9.8) | CVE-2026-51092 | Published | 2026-06-05 |
| VDR-017 | Tiendil/feeds.fun | Server-Side Request Forgery | High (7.7) | CVE-2026-51094 | Published | 2026-06-05 |
| VDR-018 | maxpumperla/elephas | Unauthenticated pickle deserialization RCE | Critical (9.8) | CVE-2026-51093 | Published | 2026-06-05 |
| VDR-019 | ltzheng/agent-studio | Unauthenticated jsonpickle deserialization RCE | Critical (9.8) | CVE-2026-51090 | Published | 2026-04-14 |
| VDR-020 | LiangYang666/ChatGPT-Web | Unauthenticated pickle deserialization RCE | Critical (9.8) | CVE-2026-51089 | Published | 2026-04-14 |
| VDR-021 | Tzahi12345/YoutubeDL-Material | Argument injection to RCE via customArgs | Critical (9.8) | CVE-2026-51088 | Published | 2026-04-14 |
| VDR-022 | develon2015/Youtube-dl-REST | OS command injection via recode | Critical (9.8) | CVE-2026-51091 | Published | 2026-04-14 |
| VDR-023 | labstack/echo | Arbitrary scheme injection in redirect middlewares | Medium (4.7) | CVE-2026-118658 | Fixed in 4.15.2 / 5.1.1 | 2026-03-20 |
All vulnerabilities are discovered through manual source code review and confirmed with working proof-of-concept exploits before disclosure. Reports are submitted via GitHub Security Advisory or the project's designated security contact, following a 90-day coordinated disclosure policy.
- Vulnerabilities are reported privately to maintainers before any public disclosure
- Maintainers are given 90 days to release a fix
- Public disclosure occurs after the fix is released or after the 90-day deadline
- Proof-of-concept code is minimal and non-weaponized
- Website: dennissepede.com · securitixsolutions.com
- LinkedIn: dennis-sepede-cybersecurity
- GitHub: @Den-Sec