wrdn-code-execution

Server-side template injection is detected by tracing untrusted input from sources like request bodies to template rendering sinks. The analysis reviews diffs touching template engines, verifies the end-to-end execution path, and documents safe alternatives.

Unsafe deserialization causes remote code execution when untrusted bytes reach a deserialization sink, triggering gadget chains. The analysis identifies these paths by reviewing diffs that handle byte deserialization and traces input to the executing sink.

Tracing untrusted input to a command execution sink involves identifying sources like headers or uploads and following the data flow to subprocess or exec calls. The analysis enforces structured verification of these paths and provides remediation steps.

Yes, you can check diffs for XXE to RCE gadget chains by analyzing changes that touch XML parsing. The analysis traces untrusted input through XML parsers to code-executing sinks, surfacing actionable findings with evidence and concrete mitigations.

Prototype pollution leads to server-side code execution when user-controlled objects are deep-merged and land on a code-executing sink. The analysis detects these paths by reviewing deep-merge operations and verifying the end-to-end execution flow.

The best way to find eval and vm usage driven by user data is to trace untrusted input from request bodies or config to eval or Function sinks. The analysis covers these execution sinks across languages and documents safe alternatives.