When the agents find something. They write it up.

The chain begins at the JSON transformer's type-tag fast-path and lands inside the plugin loader's deferred-require resolver, traversing nine call-graph hops across two packages. The transformer trusts a __sg_type field on incoming records, looks it up in a constructor registry initialised at module load, and applies the resulting class without verifying that the registry itself is intact. Because the registry is a plain object reachable via prototype, a prior pollution gadget anywhere in the same process — including the library's own merge helper, lib/util/merge.js:44 — silently grafts an attacker-chosen entry on top of the prototype chain.

The exploit is reachable from any service that logs an attacker-controlled request body before sanitisation, which is the common pattern across the affected dependents. Once the constructor lookup resolves to the polluted entry, the plugin loader's lazy-require path is invoked with the attacker-supplied module identifier; the loader then calls require() against the user-controlled string and immediately executes the module's top-level statements. The end-to-end primitive is unauthenticated remote code execution on the logging process, which on most affected deployments is the same process serving HTTP traffic.

The proposed mitigation is a one-line guard at lib/transformers/json.js:122 that rejects type-tag values whose prototype is not Object.prototype, plus a hard registry freeze applied at module load. We attached a patch to the disclosure that takes the worst-case decode time from microseconds to within the same order of magnitude — measurable but not detectable in practice. The maintainer accepted the patch with minor renaming and shipped it in 4.2.1 alongside an advisory.

Disclosure opened on D0+2 to logger-core's maintainer; acknowledgement landed inside 18 hours. The maintainer requested a 30-day extension to coordinate with two large downstream packagers that vendored the transformer; we granted it without objection. Patch shipped on D0+45, advisory cleared CVE assignment on D0+88, this dossier published on D0+92. No exploitation observed in our customer telemetry across the disclosure window.

The chain is structurally similar to several public prototype-pollution disclosures but novel in its reachability: the gadget lives in a transitive utility three hops down from any of the affected dashboards, and the sink is the dashboards' own runtime-config loader, not a third-party plugin. The polluting input is a JSON file uploaded through the dashboards' template-import surface, which all three affected products expose to authenticated tenant administrators. Privilege does not stay scoped to the tenant: the config loader is process-global and the polluted prototype affects subsequent requests across tenants.

Reachability was confirmed by running the platform's reachability proof against each dashboard's release artifact. The chain crosses obj-merge-helper's deepMergeRaw entry point (which still accepts __proto__ when the legacy options.preservePrototype flag is unset), traverses two pass-through adapters in dashboard-shell's import pipeline, and lands at the runtime-config loader's defaults-merge call. The loader then reads the now-polluted defaults during the next request lifecycle, returning attacker-chosen values for feature flags and access-control toggles.

Mitigation is a defence-in-depth pair: upstream, obj-merge-helper@2.4.7 hard-rejects __proto__ and constructor keys; downstream, dashboard-shell ships a wrapper that switches the import pipeline to a structured-clone path before merging. We proposed both patches; the maintainer of obj-merge-helper accepted the first within the window, and the dashboard-shell team picked up the wrapper in their 11.4 release.

Coordinated disclosure was multi-party: obj-merge-helper maintainer (D0+1), dashboard-shell maintainers (D0+1), and a private notice to the three affected dashboard vendors (D0+3). All five parties were on a shared timeline. Patches landed by D0+58; the affected dashboards rolled them out across customer instances by D0+74. Public dossier published D0+92.

Eagle's clustering pass surfaced twelve newly-published pypi packages whose names sit at Levenshtein distance one from a leading data-pipeline framework and three popular cloud-SDK extras. The publication times are tightly grouped — all within a 36-minute window across two author accounts — and the wheels share a deobfuscation routine, an exfiltration host pattern, and a near-identical setup.py post-install hook. Eagle's similarity score against the cluster centroid sits at 0.93 minimum and 0.99 maximum.

Each post-install script reads four files commonly mounted into CI/CD runners — ~/.aws/credentials, ~/.netrc, /run/secrets/*, and GITHUB_TOKEN from the environment — base64-encodes them, and POSTs to one of three short-lived collector hosts behind a rotating subdomain. The collector hosts share a TLS fingerprint and serve a small Go binary on a different port; we have not analysed the binary but record its hash for follow-up. The packages do not attempt any persistence on the runner beyond the single exfiltration call.

Mitigation is two-track. For the registry: we filed a takedown packet with the cluster's twelve package names, the two author handles, the three collector hostnames, and YARA signatures over the post-install script's deobfuscation routine. For customers: the platform issued automatic policy denials against the cluster within four minutes of detection, with a tenant-level allowlist override for any team that needed it. No customer telemetry recorded a successful install across the disclosure window.

The registry's security team confirmed receipt within 14 hours and completed takedown of all twelve packages within 36 hours. The two author accounts were locked. Disclosure to the registry happened on D0; coordinated public note from the registry on D0+11; this dossier on D0+78. Eagle's report includes the full cluster manifest, hash list, and a recommended hunt query for SBOM scanners.

The Normalizer treats a URL string as canonicalised once a single allowlist pass returns success, but the allowlist runs after a partial decode that strips one of three percent-encoding layers. Attacker-supplied URLs that nest a percent-encoded loopback alias inside an alternative IP encoding survive the first decode, pass the allowlist, and are then fully decoded by the downstream HTTP client at request time. The end-to-end primitive is an outbound request from the gateway process to any host reachable on its private network, including the cloud-provider metadata service.

Reachability is broad. The library is used by twelve enterprise gateway products that each accept a webhook-target URL as part of tenant configuration. In every product we tested, the configuration path validates URLs by passing them through url-builder-core's allowlist API, which means the same bypass works across all twelve. The most damaging variant is the cloud-metadata redirect: in the eight products deployed on cloud providers with IMDSv1-compatible endpoints, a successful redirect returns scoped temporary credentials directly to the gateway's logs.

Mitigation is a strict-decode mode for the Normalizer that performs all percent-decoding before any allowlist evaluation, plus an explicit refusal of three classes of IP encoding (integer-form, hex-form, and short-form loopback aliases). We attached the patch to the disclosure with a test corpus of 312 known-bypass inputs; all 312 are rejected by the patched code. The maintainer accepted the patch and shipped url-builder-core 3.1.5 with the strict-decode default on.

Disclosure coordinated with the url-builder-core maintainer (D0+1) and a private notice to each of the twelve downstream gateway vendors (D0+3). Two vendors requested an extended embargo to coordinate with their largest customers; we granted it. Patch landed upstream on D0+39, gateway rollouts completed across vendors by D0+85, dossier published D0+92.

The regex driving the quoted-local-part matcher is structurally susceptible to catastrophic backtracking when the input contains a long run of escaped quote characters followed by an unmatched terminator. The library's documentation does not state that the validator should be called on untrusted input, but a survey of dependent code shows the function is almost always invoked on request headers, query parameters, or form fields without an upstream length limit. A 1.4 KB header is enough to push event-loop latency past 30 seconds on a modern Node runtime.

The chain is reachable from any HTTP server that calls email-check-lite on a header value before length-limiting it. In four of the five frameworks we surveyed, the validator is wired into a default middleware that runs before user code; in the fifth, the framework's documentation example shows the validator being called inline on req.headers['x-customer-email'] with no guard. None of the surveyed configurations limit input length below the threshold at which backtracking becomes catastrophic.

Mitigation is a deterministic rewrite of the quoted-local-part regex that preserves the original grammar (verified against the library's existing 318-case test corpus) while collapsing the worst case from exponential to linear in input length. We attached both the rewrite and a fuzzing harness based on the library's grammar. The maintainer accepted the rewrite, added an explicit max-length parameter defaulting to 254 octets, and shipped 5.4.0.

Coordinated disclosure opened D0+1, maintainer acknowledged D0+1, patch landed D0+27, advisory cleared CVE assignment D0+74, this dossier published D0+92. No customer telemetry observed exploitation during the disclosure window; downstream patch rollout is still in progress as of publication.

This is a novel attack class within the agentic-coding ecosystem rather than a single bug. The MCP filesystem-bridge server exposes a read tool that returns file contents to the model in a structured envelope, but the envelope does not delimit user-controlled file contents from MCP control directives. A coding agent that reads an attacker-supplied repository file therefore parses the file's content as if it were instructions, including a synthetic tool-call request to the same server's exec handler with attacker-chosen arguments.

The end-to-end chain is: developer asks the agent to summarise an untrusted repository, the agent reads a poisoned source file (commonly hidden inside a Markdown comment or a docstring), the file's contents include a forged MCP tool-call directive that the agent's prompt template does not isolate, and the agent emits a real exec call with the attacker's payload. The payload exfiltrates the developer's local credentials — git config tokens, npm tokens, environment variables from the agent's process — to a webhook URL embedded in the same poisoned file.

Mitigation has three layers. First, the MCP bridge ships a content-isolation envelope that wraps every file-read result in a structured, JSON-only block the agent's template treats as data, never as instructions. Second, the bridge enforces a configurable command allowlist on the exec handler, defaulting to deny. Third, agent-side, we coordinated with three popular agentic-coding clients to ship default-deny on cross-tool exec when the source of the previous tool call was a content read. All three layers landed within the disclosure window.

Disclosure coordinated with the mcp-fs-bridge maintainer (D0+1), three agentic-coding client teams (D0+2), and a private notice to two enterprise platforms (D0+4) that had embedded the bridge in their default tool list. Patch on the bridge landed D0+33; client-side mitigations landed staggered between D0+41 and D0+68; this dossier published D0+92. A follow-up dossier on broader prompt-injection-driven tool misuse is in coordinated review.