Skip to content
Helix Nebula
esen
Contact

Security research

Vulnerabilities we have reported

We audit the software we use and protect. When we find a flaw, we reproduce it, report it privately to the project and propose a fix.

Fixed vulnerabilities
8
Projects
5
In coordinated disclosure
5

01 — Record

Published reports

Only flaws that each project has already fixed and published are listed. Reports still under review stay private until a fix ships.

  1. mail-parser

    mail-parser

  2. mailsuite

    mailsuite

    High7.5Security advisoryGHSA-9jx3-p8wm-g8vw

    MaildirConnection cannot fetch, mark read or move a message the email generator refuses to re-serialize

    A message anyone can deliver into the Maildir could not be read, marked as read or moved aside, which stalled processing of that mailbox.

    Affected
    2.0.0 – 2.3.2
    Fixed in
    2.3.3

  3. parsedmarc

    parsedmarc

    High7.5Security advisoryGHSA-qxwv-2vwj-v828

    Poison report email causes a persistent denial of service of mailbox processing

    A single small email sent to the DMARC report address stopped mailbox processing on every run until someone deleted it by hand.

    Affected
    ≤ 11.0.5
    Fixed in
    11.1.0

  4. parsedmarc

    parsedmarc

    High7.5Security advisoryGHSA-m47j-wp78-fqjg

    XML <!ATTLIST> default-attribute amplification in aggregate report parsing

    An XML report of a few KB, with no entities, made the parser spend tens of seconds of CPU and more than 1 GB of memory.

    Affected
    ≤ 11.0.5
    Fixed in
    11.1.0

  5. parsedmarc

    parsedmarc

    Medium6.5Security advisoryGHSA-j53g-34vj-g25q

    Failure-report sample filename truncated by characters, not bytes

    A subject with CJK characters or emoji exceeded the filesystem's byte limit (ENAMETOOLONG), held back the output batch and duplicated rows on every run.

    Affected
    ≤ 11.0.5
    Fixed in
    11.1.0

  6. parsedmarc

    parsedmarc

  7. Better Auth for Convex

    @convex-dev/better-auth

    High8.1Security advisoryGHSA-j8qq-g9pm-v3c2

    Cross-domain plugin can deliver a victim's session token to an attacker-controlled trusted origin

    OAuth callbacks skipped the state cookie check, and the one-time token was appended to any redirect allowed by trustedOrigins, including wildcards such as *.vercel.app. This allowed taking over another user's session.

    Affected
    < 0.12.6
    Fixed in
    0.12.6

  8. Better Auth for Convex

    @convex-dev/better-auth

    Medium6.8Security advisoryGHSA-pgx2-m66h-x29f

    Emailed links can point at an attacker's host with a dynamic baseURL

    The x-better-auth-forwarded-* headers were restored for any caller, so an attacker could choose the host used in password reset and verification links.

    Affected
    0.11.5 – 0.12.5
    Fixed in
    0.12.6

  9. RustDesk

    rustdesk

    High7.4Independent report

    (key, nonce) reuse across both directions of the session encryption

    Both peers encrypted with the same key and the same nonce counter, exposing the XOR of the plaintexts to a relay or on-path attacker. RustDesk already had another report of the same flaw and treated us as an independent reporter; the fix uses separate keys per direction.

    Fixed in
    1.5.0

02 — Method

How we report

01
We reproduce
Every flaw is confirmed with a proof of concept against the latest release and the main branch.
02
We report privately
We follow each project's security policy: GitHub private reporting, email or whatever channel they ask for.
03
We propose a fix
Whenever we can, we send a patch and help review the maintainer's fix.
04
We wait for the fix
We don't publish details until the project has shipped a fixed release.

Audits

Want us to review your software?

We audit code, dependencies and infrastructure with the same method we use for these reports.

Get in touch