Escape User Input in Regex and SQL LIKE: Tested Fixes
A search box that drops user text into new RegExp() or a LIKE pattern is a small injection bug: a dot matches anything, .* matches everything, and a % …
Tag
Python
User-Supplied Regex: How to Run It Without ReDoS
Search filters, alert rules, routing configs and log tools all end up accepting regular expressions from users. In a backtracking engine that is a …
Brotli CVE-2026-111497: Find and Patch Every Copy
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, now on CISA's KEV list. It ships inside Node.js, Python packages, Go modules, …
LLM Output Handling: Treat Model Output as Untrusted Input
OWASP's LLM05:2025 covers what happens when an application passes model output to a browser, database, shell or file path without validation. Because …
Mass Assignment: How to Stop Clients Setting role=admin
Mass assignment happens when a framework binds every field in a request onto an object, so a client can set fields like role, plan or owner that the …