// wall of bugs caught
15 critical bugs
PullLight would have caught in your PRs.
Every card below is a real bug flagged during PR review — CVEs, CWEs, before/after code. No competitors have a page like this. Try it on your own PR →
19
Total catches
15
Critical
4
High
15
CVSS ≥ 9
6
Languages
critical
# auth-bypass
TypeScript
CVE-2026-1774
Prototype Pollution → Authorization Bypass in CASL
@casl/ability's rule-building path merges attacker-controlled condition objects without sanitizing prototype keys — pollutes Object.prototype, causing all subsequent ability checks to return true.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
// Attacker payload: { "__proto__": { "can": true } }
ability.update(attackerConditions);
ability.can('delete', 'Post'); // returns true for all users!
After (fixed)
// AFTER (fixed)
import { freeze } from '@casl/ability';
ability.update(freeze(attackerConditions));
critical
# command-injection
TypeScript
CVE-2025-11953
OS Command Injection via CLI Package Installation
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
exec(`npx ${pkgName} --help`, (err, stdout) => { ... });
After (fixed)
// AFTER (fixed)
// Use execFile with argument array; validate pkgName
// against a known-good npm package name regex.
execFile('npx", [pkgName, '--help'], ...);
critical
# auth-bypass
TypeScript
CVE-2025-29927
Auth Bypass via Middleware Logic Gap
Next.js middleware checks authentication on most paths but a logic branch for static asset prefixes skips the check — authenticated pages reachable without a session.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
if (req.nextUrl.pathname.startsWith('/_next')) {
return NextResponse.next(); // skips auth!
}
return checkAuth(req);
After (fixed)
// AFTER (fixed) // Auth check runs for ALL paths; static assets // bypass the network check via CDN rewrite, not middleware. return checkAuth(req);
critical
# injection
TypeScript
CVE-2026-46624
SQL Injection leading to OS Command Execution via timeZone
twentyhq/twenty interpolates timeZone directly into a raw SQL template literal — any authenticated user can execute arbitrary SQL, chaining to OS command execution via PostgreSQL COPY TO PROGRAM.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
// timeZone interpolated into raw SQL template — SQL injection
return `date_trunc('${timeZone}', "createdAt")`;
// Attack: timeZone='UTC'; DROP TABLE users; --
After (fixed)
// AFTER (fixed)
// Whitelist-validate timeZone against known IANA strings
const ALLOWED = new Set(['UTC', 'America/New_York', ...]);
if (!ALLOWED.has(timeZone)) throw new Error('Invalid timezone');
return `date_trunc('${timeZone}', "createdAt")`;