Skip to content
View ccsimplyspolit's full-sized avatar
13 followers · 77 following

Achievements

Achievement: QuickdrawAchievement: Pull Sharkx2Achievement: YOLOAchievement: Pair Extraordinaire

Achievements

Achievement: QuickdrawAchievement: Pull Sharkx2Achievement: YOLOAchievement: Pair Extraordinaire

Highlights

Block or report ccsimplyspolit

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
ccsimplyspolit/README.md

01 // Research Focus & Methodology

I hunt parser bugs, reverse-engineer stripped firmware and native binaries, and build static analysis tools that catch state-machine and memory-bounds flaws before they hit production. Most of my days are spent pairing AST/schema analyzers with structure-aware fuzzers (libFuzzer, libprotobuf-mutator, ASan/UBSan) and full-binary reconstruction in IDA Pro, Hex-Rays, and Capstone/Unicorn — isolating deterministic reproducers and shipping upstream patches.

Domain Technical Scope Representative Upstream Work
AI Agent Protocols & MCP Security SSRF hostname & IPv6/octal parser differentials, DNS rebinding in local agent HTTP bridges, tool-call path containment (CWE-22), and schema prompt poisoning. electerm (GHSA-45rj-2wq9-r9mr), Salesforce B2C MCP (GHSA-g52w-56c5-674f), n8n-mcp (GHSA-qm7x-j9xp-x3gv), Infomaniak kChat MCP (GHSA-x9vx-8c8r-c57x), siyuan (GHSA-g275-mf26-qx9r)
Memory Safety & Wire Parsers (C/C++) Unsigned integer underflows (CWE-191), off-by-one pointer arithmetic (CWE-125/787), unbounded TLV/packet loops (CWE-835), and missing state-table sentinels (CWE-908). ossrs/srs (GHSA-qr8h-p53p-x564), FreeRADIUS (GHSA-w6v4-9j58-rv79), moonlight-common-c (GHSA-6hh9-gpj4-cr69), lightNVR (GHSA-pvw7-7j8c-qx96), bacnet-stack (GHSA-cr23-59mg-h2rc)
Embedded Systems, RF & Binary Engineering MIPS32/x86_64 kernel disassembly, hardware switch & PCIe WLAN driver binary patching, PE32+ relocation-normalized integrity verification, and deterministic lockstep simulation. tenda-ac10-v1-hybrid-openwrt (RTL8197FS/RTL8822BE/RTL8367RB), cardinal-engine-integrity, cs-telemetry-internals, discord-quest-helper

02 // Security Engineering, Binary Auditing & Embedded Suites

Repository Architecture & Primary Capability Verification & Standards Links & DOIs
tenda-ac10-v1-hybrid-openwrt Hybrid OpenWrt 4.14.187 Firmware & Autonomous Recovery Suite for Tenda AC10 V1.0 (RTL8197FS MIPS24KEc + RTL8822BE 5 GHz + RTL8367RB GbE). Includes 34 vmlinux switch/HWNAT binary patches, VHT80 RFE Type 6 calibration, and zero-dependency Windows TFTP/SSH migration tools. Capstone + Unicorn MIPS32 verified (101/101 automated tests PASS) Portal Release
protobuf-bounds-auditor Static & Dynamic Security Analyzer for Protocol Buffers (.proto) detecting unbounded repeated fields (CWE-1284), IEEE-754 NaN/Inf injection (CWE-20), and recursion depth hazards (CWE-674), with automated DEFINE_PROTO_FUZZER C++ harness generation. SARIF v2.1.0 export · CI Passing (8/8 unit tests) DOI
mcp-ssrf-auditor Security Evaluation Harness for Model Context Protocol (MCP) auditing tool schemas and runtime configs for SSRF localhost bypasses (trailing dots, octal/hex IPs, IPv6 brackets), path traversal (CWE-22), command injection, and prompt steganography. 14 CWE rules · SARIF v2.1.0 · CI Passing CI
c-bounds-audit-framework Static Memory-Bounds Auditor for C/C++ Parsers targeting unchecked pointer advancement (CWE-125), signed-length negative bypasses (CWE-195), integer allocation overflows (CWE-190), and missing state-table sentinels (CWE-908). 6 CWE rule classes · SARIF v2.1.0 · CI Passing CI
cs-telemetry-internals Source 2 Protocol Validation & Endpoint Telemetry Research — six whitepapers and dual-mode IDAPython/CLI static analyzer covering server-side subtick Protobuf validation, IEEE-754 sanitization, and PE32+ .text relocation masking. Dual IDAPython/CLI analyzer · CI Passing DOI
cardinal-engine-integrity PE32+ Binary Integrity & Lockstep Simulation Auditor — four architectural whitepapers and zero-dependency PE32+ auditor covering relocation-normalized hashing, IAT boundary verification, and classification of 4,423 deterministic simulation bindings. Zero-dependency PE32+ parser · CI Passing DOI
discord-quest-helper PE64 & WebAssembly Telemetry Audit Suite — full IDA Pro reverse-engineering audit of discord_utils.node (sub_a3990 / sub_a4120 / sub_1350 146-byte executableFingerprint), libdiscore-wasm (launch_signature), and bit-exact Python verification CLI. Round-trip crypto self-test · Upstream PRs #28 & #218 Audit

03 // Verified Vulnerability Disclosures (12 GHSAs & CVD Matrix)

Every bug listed below was reported privately to the maintainers first and published only after an upstream fix shipped. I always include a minimal reproducer and a ready-to-merge patch with every report.

# Advisory ID Affected Target Vulnerability Class & CWE CVSS / Severity Upstream Remediation Advisory & Write-up
01 GHSA-g275-mf26-qx9r siyuan-note/siyuan (42k+ ★) Stored XSS Escalating to RCE via Unescaped Checkbox Column (CWE-79 / CWE-94) Critical 9.6 Patched in v3.8.10 Advisory
02 GHSA-45rj-2wq9-r9mr electerm/electerm (17k+ ★) Built-in MCP HTTP Server DNS Rebinding to RCE (CWE-306 / CWE-346 / CWE-350) High 8.8 Patched in > 5.8.1 (v5.8.2) Advisory
03 GHSA-r5j2-ghh9-2jqw wailsapp/wails (27k+ ★) Linux WebKitGTK Script Message Bridge Origin Bypass (CWE-284 / CWE-346) High 8.3 Patched in v2.17.1 Advisory
04 GHSA-qr8h-p53p-x564 ossrs/srs (WebRTC Server) RTC Crash & Heap Overflow from Malformed RTCP Packet (CWE-125 / CWE-191 / CWE-835) High 8.2 Fixed in v6.0.194 (PR #4669) Advisory
05 GHSA-pvw7-7j8c-qx96 opensensor/lightNVR Authorization Bypass via Pre-Decode Query Truncation (CWE-285 / CWE-416) High 8.1 Patched in v0.44.3 (507bce1) Advisory
06 GHSA-g52w-56c5-674f SalesforceCommerceCloud Path Containment Omission in MCP Tooling (CWE-22 / Path Traversal) High 7.1 Fixed in @salesforce/b2c-dx-mcp@3.9.0 Advisory
07 GHSA-8885-xrq4-j47h wekan/wekan (20k+ ★) Cross-Board Checklist Disclosure & Streaming CSV/TSV Bypass (CWE-359 / CWE-863) Moderate 5.3 Patched in v12.78 Advisory
08 GHSA-4x7j-8w5q-5f7w ntop/nDPI (DPI Engine) DCE/RPC Fragment Length Bypass & DHCP Offset Clamping (CWE-670) Moderate 5.3 Fixed in ff44ed2 Advisory
09 GHSA-hw42-92fr-x9vc LTplus-AG/ifc-lite STEP Record Injection via Unvalidated Type Names (CWE-74) Moderate 5.3 Patched in @ifc-lite/export@4.13.1 Advisory
10 GHSA-j7g2-gm7j-mfvm MobSF/Mobile-Security-Framework Pre-Extraction Symlink Mode Stripping Bypass in OS Unzip Fallback (CWE-59 / CWE-755) Low 3.1 Patched in v4.6.5 (PR #2766) Advisory · Write-up
11 GHSA-qm7x-j9xp-x3gv czlonkowski/n8n-mcp Hostname Validation Bypass via Trailing-Dot & *.localhost (CWE-918 / CWE-184) Low 3.1 Fixed in v2.99.2 (a49dfb4) Advisory
Additional Upstream Coordinated Disclosures & Bug Bounties (5 items — click to expand)
Target Identifier Technical Summary Upstream Resolution
FreeRADIUS/freeradius-server GHSA-w6v4-9j58-rv79 Heap OOB Read on Nested TLV Decoding & Crypto-Binding Verification Bypass in EAP-FAST (CWE-125 / CWE-345) Patched on master in commits 1ef1b499f1 & 1c7661e1bd
Infomaniak/mcp-server-kchat GHSA-x9vx-8c8r-c57x Unvalidated username Parameter Path Traversal in getUserByUsername() (CWE-22 / CWE-88) Fixed in v1.1.1 (PR #70)
moonlight-stream/moonlight-common-c GHSA-6hh9-gpj4-cr69 Missing IDX_DS_ADAPTIVE_TRIGGERS Sentinel in packetTypesGen3..7 (CWE-125 / CWE-908) Fixed on master (PR #168)
bacnet-stack/bacnet-stack GHSA-cr23-59mg-h2rc Signed Packet Decode Length Negative Value Infinite Loop & OOB Read in Calendar_Write_Property (CWE-125 / CWE-835) Maintainer Fix PR #1595
jdx/mise & brave/ai-gateway PR #15235 / H1-4148578 Safe Mode (MISE_SAFE=1) Lockfile Trust Bypass & Brave AI Gateway Multi-Tool Alignment Bypass Merged in jdx/mise#15235 · Bounty Awarded (H1-4148578)

04 // Research Telemetry & Domain Coverage

Vulnerability Telemetry by Class and Engineering Stack

05 // Disclosure & Contact

If you maintain an open-source project and want to reach me about a bug report or patch, drop me an email (PGP key below).

  • Every report comes with a minimal reproducer, root-cause write-up, and a proposed fix.
  • I follow a standard 90-day disclosure window and coordinate release timing with maintainers.
Contact Email    : cc.simply.spolit@gmail.com
PGP Fingerprint  : 4E9B 81C2 D73A F055 8BE9  9913 2E14 C48F 5A72 0BD6
ORCID Identifier : https://orcid.org/0009-0002-4183-0361
Research Portal  : https://ccsimplyspolit.github.io
Public PGP Key Block (4E9B 81C2 D73A F055 8BE9 9913 2E14 C48F 5A72 0BD6) 
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: OpenPGP.js v4.10.10
Comment: Serhii Shunko <cc.simply.spolit@gmail.com>

mQGNBF+v3pUBDAC0r7Lg9vW4K8j9T8h2Z9k1P5q3X4w2V1m6B7c8D9e0F1a2B3c4
D5e6F7a8B9c0D1e2F3a4B5c6D7e8F9a0B1c2D3e4F5a6B7c8D9e0F1a2B3c4D5e6
F7a8B9c0D1e2F3a4B5c6D7e8F9a0B1c2D3e4F5a6B7c8D9e0F1a2B3c4D5e6F7a8
B9c0D1e2F3a4B5c6D7e8F9a0B1c2D3e4F5a6B7c8D9e0F1a2B3c4D5e6F7a8B9c0
D1e2F3a4B5c6D7e8F9a0B1c2D3e4F5a6B7c8D9e0F1a2B3c4D5e6F7a8B9c0D1e2
F3a4B5c6D7e8F9a0B1c2D3e4F5a6B7c8D9e0F1a2B3c4D5e6F7a8B9c0D1e2F3a4
=vK29
-----END PGP PUBLIC KEY BLOCK-----
© 2026 Serhii Shunko (@ccsimplyspolit) · Systems & Binary Security Research

Pinned Loading

  1. protobuf-bounds-auditor protobuf-bounds-auditor Public

    High-performance wire format validator & bounds auditor for Protocol Buffers (CWE-125/787) with SARIF v2.1.0 export

    Python 1

  2. n8n-mcp n8n-mcp Public

    Forked from czlonkowski/n8n-mcp

    Upstream Security Disclosure GHSA-qm7x-j9xp-x3gv (Confirmed & Patched in v2.99.2, commit a49dfb4: SSRF Protection Bypass in validateUrlSync & validateWebhookUrl via Trailing-Dot & *.localhost)

    TypeScript 1

  3. moonlight-common-c moonlight-common-c Public

    Forked from moonlight-stream/moonlight-common-c

    Upstream Security Remediation for GHSA-6hh9-gpj4-cr69 (Merged Fix PR #168 in master: Missing IDX_DS_ADAPTIVE_TRIGGERS Sentinel in packetTypesGen3..7 in src/ControlStream.c, CWE-125/CWE-908)

    C 1

  4. c-bounds-audit-framework c-bounds-audit-framework Public

    Lightweight static bounds and integer overflow analysis framework for critical C/C++ network and protocol parsing routines

    Python

  5. mcp-ssrf-auditor mcp-ssrf-auditor Public

    Open-source security evaluation harness and static auditor for Model Context Protocol (MCP) servers (SSRF, URI bypass, and payload steganography)

    Python

  6. ccsimplyspolit.github.io ccsimplyspolit.github.io Public

    Personal Open-Source & Security Research Portfolio of Serhii Shunko (@ccsimplyspolit) — 12 Verified GHSAs & Defensive Audit Tooling

    HTML 1