// case studies

Real CVEs. Real code. PullLight caught them.

Thirty-one vulnerabilities across popular npm, Python, PHP, Go, and Java packages — flagged by AI review before they shipped. Ordered by CVSS score.

Browse by bug class →

Pre-Auth RCE via Unescaped Blade Template Injection

LaRecipe SSTI RCE

RCE via Unvalidated RSC Deserialization

React2Shell RCE

Prototype Pollution / Sandbox Escape

vm2 Sandbox Escape

PHP Object Deserialization via _from Parameter

Roundcube Post-Auth RCE

Pre-Auth RCE via Unescaped Jinja2 Template Context

ERPNext Dunning SSTI RCE

RCE via eval() on Unsanitized Auth Metadata

Winston Auth RCE

Prototype Pollution → Authorization Bypass

CASL Prototype Pollution

CLI Argument Injection via args4j expandAtFiles()

Jenkins CLI Argument Injection

Path Equivalence + Unsafe Deserialization in DefaultServlet

Tomcat Partial PUT RCE

RCE via Partial PUT Path Equivalence

Apache Tomcat Path Equivalence RCE

OS Command Injection via CLI Package Installation

React Native CLI Command Injection

@react-native-community/cli

SQL Injection via Backslash-Escape Bypass

AVideo SQL Injection

Supply-Chain SSTI via Model-Supplied Jinja2 Template in GGUF Reranking

SGLang GGUF SSTI RCE

SQL Injection via Unvalidated Column Aliases

Django JSONField SQL Injection

Path Traversal via Unsanitized File Write

jsPDF Path Traversal

TOCTOU Race in HTTP Pipelining

Waitress TOCTOU Race

Auth Bypass via Middleware Logic Gap

Next.js Auth Bypass

Arbitrary File Read via pct-decoding in claims parsing

golang-jwt/jwt Claims Parsing File Read

SQL Injection leading to OS Command Execution via timeZone

Twenty CRM SQLi to RCE

twentyhq/twenty

Sandbox Escape via unsafe vm.compile

jsonpath-plus RCE

Prototype Pollution via Plain Object CSP Parsing (CWE-1321)

@helmetjs CSP Parser Prototype Pollution

@helmetjs/csp-parser

axios SSRF via NO_PROXY Environment Variable Bypass

axios SSRF via NO_PROXY Bypass

WebSocket Upgrade Handler SSRF

Next.js WebSocket SSRF

Authentication Bypass under Actuator Health Groups Paths

Spring Boot Auth Bypass

SSRF via IPv4/IPv6 Canonicalization Bypass

ip Package SSRF Bypass

Want PullLight watching your PRs?
Catches bugs like these before they merge — no config required.

Try the live demo →