Command Injection in Google Gemini CLI
Project: google-gemini/gemini-cli (80K Stars)
Type: Command Injection • 4 Bypass Techniques
Status: Google Cloud VRP, Bounty Confirmed
Analysis: Blog Post (Coming Soon)
Discovered critical command injection vulnerability with 4 distinct bypass techniques in Google’s official Gemini CLI tool on its first day of release. Successfully reported through Google Cloud VRP with bounty confirmed.
Current Working Directory Bypass in Google Gemini CLI
Project: google-gemini/gemini-cli (80K Stars)
Type: Path Restriction Bypass
Status: Google Cloud VRP
Analysis: Blog Post (Coming Soon)
Discovered path restriction bypass allowing unauthorized file system access beyond intended working directory boundaries in Google Gemini CLI.
Path Traversal in Microsoft Azure NLWeb
Project: Microsoft Azure NLWeb (Agentic Web Protocol)
Type: Path Traversal
Status: Disclosed May 28, 2024 • Patched June 2024
Media: The Verge + 30 international outlets
Analysis: Blog Post (Coming Soon)
Discovered classic path traversal vulnerability in Microsoft’s Agentic Web protocol that could expose API keys and credentials. Featured in exclusive interview with The Verge and subsequently covered by 30+ international media outlets across 15+ countries in 10+ languages.
CVE-2024-39693: Denial of Service in Next.js
Project: vercel/next.js (135K Stars)
Type: Denial of Service (DoS)
CVE: CVE-2024-39693
CVSS: 8.7 (High)
Affected: < 13.5
Analysis: Blog Post (Coming Soon)
High-severity denial of service vulnerability in Next.js, one of the most popular React frameworks affecting thousands of production applications worldwide.
Path Traversal & RCE in Anthropic MCP Servers
Project: modelcontextprotocol/servers (68K Stars)
Type: Path Traversal & Remote Code Execution
Fix: Pull Request #2726
Analysis: Blog Post (Coming Soon)
Discovered multiple vulnerabilities in Anthropic’s Model Context Protocol servers: Path Traversal in Git MCP and JSON Config Injection in Memory MCP enabling potential RCE.
CVE-2025-55322: RCE in Microsoft OmniParser
Project: microsoft/OmniParser (23K Stars)
Type: Remote Code Execution
CVE: CVE-2025-55322
Root Cause: Authentication Failure & DNS Rebinding
Analysis: Blog Post (Coming Soon)
Remote code execution vulnerability in Microsoft’s OmniParser GUI agent combining authentication bypass with DNS rebinding attacks.
CVE-2025-27508: Weak Cryptography in NSA Emissary Project
Project: NationalSecurityAgency/emissary
Type: Weak Cryptographic Algorithm
CVE: CVE-2025-27508
CVSS: 7.5 (High)
Affected: < 8.24.0
Analysis: Blog Post (Coming Soon)
Weak cryptographic algorithms in NSA’s distributed P2P data-driven workflow system affecting confidentiality and integrity of distributed communications.
Responsible Disclosure
All vulnerabilities are reported through responsible disclosure processes, working directly with vendors to ensure proper remediation before public disclosure. Active relationships maintained with major security teams including Google, Microsoft, Anthropic, and open source projects.