About Me

• Security Researcher / CTF Player @W4llz

---

Awards

Year	Name	Award
2026	Jiyong	NASA VDP (Vulnerability Disclosure Program) - Hall of Fame
2026	W4llz	NO HACK NO CTF 2026 1st
2026	W4llz	SekaiCTF 2026 2nd
2026	W4llz	Break The Syntax CTF 2026 2nd
2025	Jiyong	Google Cloud VRP (Vulnerability Reward Program) - Honorable Mention

---

Hall of Fame

• NASA (cFS)
  • Core Flight System
• Google Bug Hunters
  • Google Cloud VRP – ingress-gce S2 Severity Issue report

---

CVEs

CVE-2026-15921 — LTS Alias Path Traversal in nvm

Target

• nvm-sh/nvm

Summary

• Path traversal vulnerability caused by insufficient validation of mirror-supplied LTS codenames.
• A malicious or compromised Node.js mirror could write outside $NVM_DIR/alias/lts and overwrite shell startup files such as ~/.bashrc, ~/.zshrc, or ~/.profile, potentially leading to command execution when the shell starts.

References

• Advisory: https://github.com/nvm-sh/nvm/security/advisories/GHSA-4ghp-wxpw-rhpg
• CVE: https://www.cve.org/CVERecord?id=CVE-2026-15921

CVE-2026-48718 — Firebird

Status

• Coordinated disclosure (technical details will be published after the embargo).

CVE-2026-1665 — Command Injection in nvm

Target

• nvm-sh/nvm

Summary

• Command injection caused by insufficient validation of environment variables during wget invocation.

References

• Advisory: https://github.com/nvm-sh/nvm/security/advisories/GHSA-4fc5-r4vr-8rp7
• CVE: https://www.cve.org/CVERecord?id=CVE-2026-1665

CVE-2025-69262 — Command Injection in pnpm

Target

• pnpm/pnpm

Summary

• Command injection through environment variable substitution, potentially leading to arbitrary code execution in CI/CD and build environments.

References

• Advisory: https://github.com/advisories/GHSA-2phv-j68v-wwqx

CVE-2025-14550 — Denial of Service in Django

Target

• django/django

Summary

• Super-linear processing of repeated HTTP headers in the ASGI request path, enabling a potential denial-of-service attack.

References

• Advisory: https://github.com/advisories/GHSA-33mw-q7rj-mjwj

---

Contact

• Name: Jiyong Yang (양지용)
• Contact: [email protected]