Skip to main content

Recent

RCE in buf CLI (from http://buf.build)

A malicious protobuf registry can return a file:// verification URL during device auth; the buf CLI opens it via the OS default handler (e.g. macOS open), enabling client-side code execution during login.