Woke up to find my latest CVE (CVE-2026-5760) showcased in Mental Outlaw's newest video :D
mom, i'm on tv!
youtube.com/watch?v=u3XlqKBe…
@stuub retweeted
🛑 SGLang CVE-2026-5760 turns malicious GGUF models into RCE
CERT/CC says SGLang CVE-2026-5760 can turn malicious GGUF model files into remote code exec…
🔗 Details → invaders.ie/resources/blog/v…
@stuub retweeted
⚠️ SGLang has a critical flaw enabling remote code execution (CVSS 9.8) via malicious GGUF model files.
A crafted Jinja2 template runs when /v1/rerank is triggered, executing attacker code on the server.
🔗 How GGUF templates become an RCE path → thehackernews.com/2026/04/sg…
1st CVE of the year for me :D CVE-2026-5760
RCE in SGLang via unsandboxed Jinja2 chat template rendering
Published a bare bones PoC alongside the CVE advisory, available on Github.
enjoy.
cve.org/CVERecord?id=CVE-202…
github.com/Stuub/SGLang-0.5.…
Full Advisory Detail for CVE-2026-5760:
kb.cert.org/vuls/id/915947
Tfw you get a WAF bypass across 16 subdomains
>chain a path normalisation desync
>finds internal swagger-config unauth
>treasure trove of routes (gRPC and OpenAPI)
>Finds internal CAs, Write operations across prod, etc
> submits… duplicate of someone’s informational submission
> another aimbot/wallhack project on github
> obfuscated js in the repo
> mild attempts at hiding callbacks
> one of them is a paintball company website
> someone compromised a paintball company to deliver malware, incredible...
> clicking intensifies
> msi installer drops
...
> find the c2
> gRPC
> over tor
> a RAT
> in 2026
> stealing crypto wallets
> realise that society is healing
ioc(s):
> bodycam-wallhack-2.github(dot)io/.github/
> aaagamesinfo(dot)com
>yuhvgbzsa66biqeatbmdvfo5b5jjefcmz5t2vjuvco5qtdkshfpabyid(dot)onion:50051
> *-1773909147.msi - (sha256)
>3d05364cc87f1db48eda02a8685401ffb2b86b80708c325f8803c6caac11a88d
#CTI #CTH #threatintel
@I_Am_Jakoby Please contact me. Due to a lack of other means of contacting you I’m forced to make this public post, for now.
I’ve discovered a critical server-side vulnerability on your site. Got all of the evidence for PoC, if you wanna jump in a call let me know :)
-stuub
Awesome weekend competing in the NahamCon 2025 CTF! Found some writeup worthy (likely unintended) bugs I'm looking forward to sharing :D
Thanks @nahamsec @_JohnHammond @BuildHackSecure @HuskyHacksMK @kkevsterrr and all others involved! #NahamCon2025
@stuub retweeted
🚀 I just released a new Metasploit module for Invision Community ≤ 5.0.6 (CVE-2025-47916)!
🔗 PR: github.com/rapid7/metasploit…
Ending the day with 4 CVE submissions
for unrestricted file upload -> RCE!
With a total of 5 bugs today, also discovering an auth bypass. Which when chained with the other vulnerable components, gives us zero auth RCE 🔥
#CVE #MITRE #BugBounty #RCE
Just submitted my first CVE of 2025! Starting it off with an RCE 🔥
Excited to share more when possible
Teaser for the newest exploit ;)
Command execution via untrusted parameters during file upload. Fun to build, even more fun to use.
Updates soon here and @ github.com/stuub
#CVE2025 #CVE #BugBounty #RCE
New Release: GitHush
Why git blame when you can catch secrets leaking live from public GitHub commits?
Come check it out: github.com/Stuub/GitHush
Big thanks to @advocatemack for the inspiration during his Git Events talk at BSides last year!
(yes it's been shelved that long)
