News for hackers. Stuff that matters.

A comment on How We Exploited CodeRabbit: From Simple PR to RCE and Write Access on 1M Repos. Parent comment

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by yunohn on Tuesday August 19, 2025 @02:15PM (#44954533)
While I fully understand that things sometimes get missed, it just seems really bizarre to me that somehow “sandboxing/isolation” was never considered prior to this incident. To me, it feels like the first thing to implement in a system that is explicitly built to run third party untrusted code?
[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by wging on Tuesday August 19, 2025 @02:26PM (#44954652)
The article seems to imply that something of the sort had actually been attempted prior to the incident, but was either incomplete or buggy. I'm not sure the details would be entirely exculpatory, but unless you want to flatly disbelieve their statements, "not considered" isn't quite right.

> After responsibly disclosing this critical vulnerability to the CodeRabbit team, we learned from them that they had an isolation mechanism in place, but Rubocop somehow was not running inside it.

[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by roywiggins on Tuesday August 19, 2025 @03:39PM (#44955472)
It seems to me that they thought the linter would be safe to run as it wasn't meant to actually run untrusted code, just statically analyze it.
[ Parent | on HN ]