Skip to content
Vettalon

Vettalon / Research records

Evidence wall

Each published case separates upstream sources, observed tests, and unverified scope.

Two historical focused detections and one original Vettalon discovery are labeled separately. Ammonia traces the product candidate and draft, human submission, upstream fix, and scoped regression. Unpublished candidates are excluded.

3 public records

ammoniaCargo
Original discoveryFixed-version regression verified

Case-sensitive CSS URL filtering gap

The upstream advisory says uppercase URL() can bypass configured CSS URL filtering and permit tracking pixels in some settings; it explicitly says this is not XSS.

Vettalon supply-chain hunt surfaced a needs_human candidate in ammonia 4.1.7 and generated a disclosure draft on 2026-10-14 UTC. A human reproduced and submitted it; upstream fixed it. The maintainer publicly confirms receiving an email from zhixuli0406, and RustSec credits Louis Li as reporter. Scoped policy tests passed 3/5 on 4.2.3 and 5/5 on official 4.2.4.

GHSA-x43w-36pp-96g3
Read evidence
aiohttpPyPICWE-22
Historical vulnerabilityDetection match (historical test)

Static file path traversal

Static resource handling with follow_symlinks enabled can expose files outside the static root.

Historical focused scan matched web_urldispatcher.py:666, ending at needs_human. No HTTP exploit or fixed-version comparison was executed.

CVE-2024-23334
Read evidence
PHPUnitPackagistCWE-94
Historical vulnerabilityDetection match (historical test)

Code injection in a test helper

A web-accessible legacy eval-stdin.php can execute PHP supplied in an HTTP request body.

Historical focused scan matched eval-stdin.php:3 as a candidate. No web SAPI execution or fixed-version comparison was performed.

CVE-2017-9841
Read evidence