Kaya Emre Arıkan
Security Research & Responsible Disclosure
I find and responsibly disclose vulnerabilities in open-source software, from web frameworks to CLI tools to language runtimes. This is where I write up the findings that vendors have already made public.
Recent writeups
-
MariaDB Connector/Node.js: pool.escape() SQL injection when busy High
-
Nitro: Open Redirect Through a Backslash in Wildcard Redirects Medium
-
Missing Host Validation in mcp-proxy High
-
SunEditor: srcdoc survives the iframe placeholder rebuild in clean() High
-
SunEditor: a digit in a namespaced tag skips attribute cleaning Medium
Recent research