// wall of bugs caught
15 critical bugs
PullLight would have caught in your PRs.
Every card below is a real bug flagged during PR review — CVEs, CWEs, before/after code. No competitors have a page like this. Try it on your own PR →
19
Total catches
15
Critical
4
High
15
CVSS ≥ 9
6
Languages
critical
# auth-bypass
TypeScript
CVE-2026-1774
Prototype Pollution → Authorization Bypass in CASL
@casl/ability's rule-building path merges attacker-controlled condition objects without sanitizing prototype keys — pollutes Object.prototype, causing all subsequent ability checks to return true.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
// Attacker payload: { "__proto__": { "can": true } }
ability.update(attackerConditions);
ability.can('delete', 'Post'); // returns true for all users!
After (fixed)
// AFTER (fixed)
import { freeze } from '@casl/ability';
ability.update(freeze(attackerConditions));
critical
# command-injection
TypeScript
CVE-2025-11953
OS Command Injection via CLI Package Installation
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
exec(`npx ${pkgName} --help`, (err, stdout) => { ... });
After (fixed)
// AFTER (fixed)
// Use execFile with argument array; validate pkgName
// against a known-good npm package name regex.
execFile('npx", [pkgName, '--help'], ...);
critical
# auth-bypass
TypeScript
CVE-2025-29927
Auth Bypass via Middleware Logic Gap
Next.js middleware checks authentication on most paths but a logic branch for static asset prefixes skips the check — authenticated pages reachable without a session.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
if (req.nextUrl.pathname.startsWith('/_next')) {
return NextResponse.next(); // skips auth!
}
return checkAuth(req);
After (fixed)
// AFTER (fixed) // Auth check runs for ALL paths; static assets // bypass the network check via CDN rewrite, not middleware. return checkAuth(req);
critical
# injection
TypeScript
CVE-2026-46624
SQL Injection leading to OS Command Execution via timeZone
twentyhq/twenty interpolates timeZone directly into a raw SQL template literal — any authenticated user can execute arbitrary SQL, chaining to OS command execution via PostgreSQL COPY TO PROGRAM.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
// timeZone interpolated into raw SQL template — SQL injection
return `date_trunc('${timeZone}', "createdAt")`;
// Attack: timeZone='UTC'; DROP TABLE users; --
After (fixed)
// AFTER (fixed)
// Whitelist-validate timeZone against known IANA strings
const ALLOWED = new Set(['UTC', 'America/New_York', ...]);
if (!ALLOWED.has(timeZone)) throw new Error('Invalid timezone');
return `date_trunc('${timeZone}', "createdAt")`;
high
# ssrf
TypeScript
CVE-2024-39338
axios SSRF via NO_PROXY Environment Variable Bypass
axios < 1.7.4 does not correctly honor the NO_PROXY environment variable, allowing internal network access via crafted hostnames that should be excluded by NO_PROXY.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
// Proxy route handler — passes user-controlled URL to axios.get()
// Attacker sets Host: internal.internal.com, NO_PROXY should block
// but axios < 1.7.4 ignores it, routing to 169.254.169.254 metadata
app.get('/proxy', async (req, res) => {
const target = req.query.url;
const resp = await axios.get(target); // SSRF!
After (fixed)
// AFTER (fixed)
// 1. Upgrade axios >= 1.7.4 which properly honors NO_PROXY
// 2. Defense-in-depth: hostname allowlist
const ALLOWED_HOSTS = new Set(['api.example.com', 'status.example.com']);
function isAllowedHost(url) {
try {
const { hostname } = new URL(url);
return ALLOWED_HOSTS.has(hostname);
} catch { return false; }
}
if (!isAllowedHost(target)) return res.status(403).send('Blocked');
const resp = await axios.get(target);
high
# ssrf
TypeScript
CVE-2026-44578
WebSocket Upgrade Handler SSRF
Next.js WebSocket upgrade path forwards the Host header to an internal service without validation — attacker can redirect the upgrade to any internal host.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
const target = req.headers.host;
proxyWs(req, socket, head, { target });
After (fixed)
// AFTER (fixed)
const allowedHosts = new Set(['app.example.com']);
const host = req.headers.host?.split(':')[0];
if (!allowedHosts.has(host)) return socket.destroy();
proxyWs(req, socket, head, { target: host });