Isabel Mill
I’m izzysec, a security researcher. This site collects write-ups of the CVEs I have reported. Check out my X too.
Write-ups
-
HIGH8.6
How a line break got me code execution on your build server
A hidden line break in a downloaded project tricked Git LFS into running the attacker's program, on laptops and build servers alike. How it worked and the fix in 3.8.1.
-
CRITICAL9.0
How I got malware past code review
Gitea showed reviewers one file and let CI run another with the same name. How duplicate tree entries split code review from checkout, and the fix in 28.0.0.
-
HIGH7.1
Pollute one prototype, steal every Git token
Prototype pollution in isomorphic-git: one look at a malicious Git server's branch list could make an app send its later Git logins, even for GitHub, to the attacker's proxy.
-
HIGH8.8
A poisoned Git link could run commands on your server, logged in as you
In libgit2's libssh2 SSH backend, a single quote in a repository address could make the SSH server run extra commands as the account you log in with.
-
CRITICAL9.8
Same design flaw, three different AI coding CLIs, one Critical CVE
A settings file inside a downloaded project could make OpenAI's Codex CLI start a program of the attacker's choosing, and the same mistake turned up in Gemini CLI, GitHub Copilot CLI and Claude Code.