this post was submitted on 11 Feb 2026
8 points (100.0% liked)

Security

2136 readers
5 users here now

A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.

Rules :

  1. All instance-wide rules apply.
  2. Keep it totally legal.
  3. Remember the human, be civil.
  4. Be helpful, don't be rude.

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

founded 3 years ago
MODERATORS
Vacant@programming.dev
8
Breaking Down CVE-2026-25049: How TypeScript Types Failed n8n's Security (hetmehta.com)
submitted 5 months ago by codeinabox@programming.dev to c/security@programming.dev
4 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.bestiver.se/post/919467

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] Kissaki@programming.dev 1 points 4 months ago

Sanitizer logic: Skips execution (wrong type)

But why? Why does it "skip" when there's logic there? That doesn't make sense.

If someone passes an object with a length property, this works. If they pass an array, it works.

This later example explains how it can work for some logic. But it doesn't correlate to the actual exploitation or code in question.