Critical RCE Vulnerabilities in React and Next.js

Re:Critical RCE Vulnerabilities in React and Next.js by nostrademons on Wednesday December 03, 2025 @12:26PM (#46137280)

So smart quotes is now an LLM tell? You know that a lot of people write in word processors that automatically replace standard quotes with smart quotes (like, say, MS Word), and that these word processors can then export HTML straight into your block or preserve the smart quotes across a copy & paste? Several blog WYSIWYG editors will also directly insert them as well.

[ Parent | on HN ]

Re:Critical RCE Vulnerabilities in React and Next.js by NitpickLawyer on Wednesday December 03, 2025 @12:35PM (#46137410)

I think what they're saying is that having both in a document is the tell.

[ Parent | on HN ]

Re:Critical RCE Vulnerabilities in React and Next.js by nostrademons on Wednesday December 03, 2025 @01:10PM (#46137855)

The document doesn't have both in it. It's possible it was edited, but someone else in the thread posted the archive.org original version, and it also doesn't have smart quotes:

https://web.archive.org/web/20251203162416/https://www.wiz.i...

(Note also that you can end up with mismatched quotes if you paste in a segment of text from some other source that uses them, which is pretty common in journalism for a fast-changing story.)

[ Parent | on HN ]

Re:Critical RCE Vulnerabilities in React and Next.js by mmsc on Wednesday December 03, 2025 @01:16PM (#46137925)

https://archive.md/2025.12.03-165833/https://www.wiz.io/blog...

Mismatched smart quotes are visible in this archive.

[ Parent | on HN ]