Security on GMO Flatt Security Research

Poisoning Claude Code: One GitHub Issue to Break the Supply Chain

Mon, 01 Jun 2026 00:00:00 +0000

Introduction

Hello, I’m RyotaK ( @ryotkak ), a security researcher at GMO Flatt Security Inc.

After publishing my previous article ( Pwning Claude Code in 8 Different Ways ), I continued investigating Claude-related products and found several more vulnerabilities.

In this article, I will explain a vulnerability in Claude Code’s GitHub Actions that could allow an attacker to compromise any repository that uses the Claude Code workflow, including Anthropic’s own repositories.¹

Note: Variants of the misconfiguration issues described in this article were actively exploited in the wild before this article was published.

Remote Command Execution in Google Cloud with Single Directory Deletion

Mon, 23 Mar 2026 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc.

A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google.

During this event, I discovered a remote command execution vulnerability in one of Google Cloud’s services. As the vulnerability has now been fixed, I would like to share the technical details in this article.

TL;DR

Google Cloud has a product called Looker, and this product has a feature to manage Git repositories.

Pwning Claude Code in 8 Different Ways

Mon, 12 Jan 2026 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc.

A few months ago, I came across an interesting behavior while using Claude Code—it executed a command without my approval.

Since I wasn’t using the permission bypass mode, I decided to investigate further to understand why it was able to execute commands without explicit approval.

TL;DR

I discovered 8 ways to execute arbitrary commands in Claude Code without user approval.

LLM App Security: Risk & Prevent for GenAI Development

Wed, 29 Oct 2025 00:00:00 +0000

Introduction

Hello, I’m Sato (@Nick_nick310 ), a security engineer at GMO Flatt Security Inc.

In recent years, the evolution and widespread adoption of Large Language Models (LLM) have been remarkable, and they are being utilized as generative AI in many services and business processes. While LLMs bring significant benefits, new security risks stemming from their characteristics have also been pointed out, making sufficient understanding and countermeasures essential for safe utilization. What kind of security challenges might arise when integrating LLMs into your company’s services and operations?

Securing LLM Function-Calling: Risks & Mitigations for AI Agents

Wed, 29 Oct 2025 00:00:00 +0000

Introduction

Hello. I’m Yamakawa (@dai_shopper3 ), a security engineer at GMO Flatt Security, Inc.

LLMs exhibit high capabilities in various applications such as text generation, summarization, and question answering, but they have several limitations when used alone. Fundamentally, a standalone model only has the function of generating strings in response to input natural language. Therefore, to create an autonomous AI based on an LLM, a means to exchange information with the outside and execute concrete actions is necessary.

Security Risks of LLM Frameworks with Case Studies

Wed, 29 Oct 2025 00:00:00 +0000

Introduction

Hello. I’m Mori (@ei01241 ), a security engineer at GMO Flatt Security, Inc.

In recent years, the evolution of Large Language Models (LLMs) has accelerated the development of a wide range of AI applications, such as chatbots, data analysis/summarization, and autonomous agents. LLM frameworks like LangChain and LlamaIndex abstract LLM collaboration and external data connections to improve development efficiency, but behind this convenience lie new security risks.

In this article, we will explain common vulnerabilities that tend to occur when using or developing LLM frameworks, illustrated with specific CVEs, and learn lessons from each vulnerability. We will also introduce countermeasures that developers should be aware of based on these lessons.

CVE-2025-59489: Arbitrary Code Execution in Unity Runtime

Fri, 03 Oct 2025 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc.

In May 2025, I participated in the Meta Bug Bounty Researcher Conference 2025. During this event, I discovered a vulnerability (CVE-2025-59489) in the Unity Runtime that affects games and applications built on Unity 2017.1 and later.

In this article, I will explain the technical aspects of this vulnerability and its impact.

This vulnerability was disclosed to Unity following responsible disclosure practices.
Unity has since released patches for Unity 2019.1 and later, as well as a Unity Binary Patch tool to address the issue, and I strongly encourage developers to download the updated versions of Unity, recompile affected games or applications, and republish as soon as possible.

Why XSS Persists in This Frameworks Era?

Tue, 08 Jul 2025 00:00:00 +0000

Introduction

Hi, I’m canalun (@i_am_canalun ), a security researcher at GMO Flatt Security Inc.

This article explores the question: “Why Does XSS Still Occur So Frequently?” We will delve into why this notorious and classic vulnerability despite the widespread adoption of built-in XSS countermeasures in modern development frameworks.

The world of web development, especially frameworks, is evolving at a rapid pace, bringing improvements not only in development efficiency but also in security.

Achieving RCE in famous Japanese chat tool with an obsolete Electron feature

Wed, 19 Feb 2025 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc.

A while ago, I reported a remote code execution vulnerability that chains multiple problems in Chatwork, a popular communication tool in Japan.

In the report that I sent to the bug bounty platform, I used an obsolete feature of Electron to escalate to the preload context.
As the vulnerability was interesting, I’m writing this article to share the details of it.

Clone2Leak: Your Git Credentials Belong To Us

Sun, 26 Jan 2025 00:00:00 +0000

Introduction

Hello, I’m RyotaK ( @ryotkak ), a security engineer at GMO Flatt Security Inc.

In October 2024, I was hunting bugs for the GitHub Bug Bounty program. After investigating GitHub Enterprise Server for a while, I felt bored and decided to try to find bugs on GitHub Desktop instead.

After reading the source code of GitHub Desktop, I found a bug that allows a malicious repository to leak the user’s credentials.
Since the concept of the bug is interesting, I decided to investigate other Git-related projects and found many bugs.

Non-Intrusive Web Recon: Techniques from Chrome DevTools Recorder

Wed, 25 Dec 2024 00:00:00 +0000

Introduction: The Art of Non-Intrusive Web Recon

Hello, I’m pizzacat83 (@pizzacat83 ), a software engineer at Flatt Security Inc.

When hunting for bugs, understanding the behavior of a target application is invaluable. The more knowledge you gain about the application—where each functionality resides, how pages and APIs interconnect—the greater your ability to pinpoint weaknesses and unravel vulnerabilities.

Imagine a tool that could seamlessly assist with this process, extracting key insights from the browser in real-time as you navigate through the application. A tool that, while you click through the interface, captures the underlying DOM structure, traces interactions, and reveals valuable data connections—all without disrupting your flow. This would make it possible to map the application’s behavior as you go, without needing to slow down to document every detail manually.

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

Fri, 06 Dec 2024 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc.

A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.¹ After accessing the LuCI, which is the web interface of OpenWrt, I noticed that there is a section called Attended Sysupgrade, so I tried to upgrade the firmware using it.

After reading the description, I found that it states it builds new firmware using an online service.

Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit

Fri, 02 Aug 2024 00:00:00 +0000

Introduction

Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc.

In 2023, James Kettle of PortSwigger published an excellent paper titled Smashing the state machine: the true potential of web race conditions.
In the paper, he introduced a new attack technique called single-packet attack that can exploit a race condition without being affected by the network jitter.

Quoted from Smashing the state machine: the true potential of web race conditions

Recently, I encountered a limit-overrun type of race condition that requires sending approximately 10,000 requests simultaneously to exploit reliably, so I attempted to apply the single packet attack to it.
However, due to the single packet attack’s limitation, which restricts the maximum size of requests that can be sent to around 1,500 bytes, I couldn’t exploit the vulnerability.

BatBadBut: You can't securely execute commands on Windows

Tue, 09 Apr 2024 00:00:00 +0000

Introduction

Hello, I’m RyotaK ( @ryotkak ), a security engineer at Flatt Security Inc.

Recently, I reported multiple vulnerabilities to several programming languages that allowed an attacker to perform command injection on Windows when the specific conditions were satisfied.
Today, affected vendors published advisories of these vulnerabilities , so I’m documenting the details here to provide more information about the vulnerabilities and minimize the confusion regarding the high CVSS score.

TL;DR

The BatBadBut is a vulnerability that allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Finding bugs to trigger Unauthenticated Command Injection in a NETGEAR router (PSV-2022–0044)

Sat, 26 Mar 2022 00:00:00 +0000

Preface

Hi, I’m stypr (@stereotype32 ) from Flatt Security Inc.

Last year, I wrote a blog post about technical explanations about 0days found in Japanese OSS products.

I have found a lot of vulnerabilities in various products since then. Unfortunately, most bugs I found did not get it fixed right away, so I did not get any chances to share some exciting vulnerabilities I found until today.

This article will explain how I found various vulnerabilities and chained some of the vulnerabilities into an unauthenticated command execution without any preconditions in a NETGEAR’s WAC124(AC2000) router.

Finding an unseen SQL Injection by bypassing escape functions in mysqljs/mysql

Tue, 22 Feb 2022 00:00:00 +0000

TL;DR

It was found that unexpected behaviors in the query’s escape function could cause a SQL injection in mysqljs/mysql (https://github.com/mysqljs/mysql ), which is one of the most popular MySQL packages in the Node.js ecosystem.

Typically, query escape functions or placeholders are known to prevent SQL injections. However, mysqljs/mysql is known to have different escape methods over different value types, and it could eventually cause unexpected behaviors when the attacker passes the parameter with a different value type. Unexpected behaviors include buggy behaviors and SQL injections.

CVE-2020–15702 Race Condition vulnerability in handling of PID by apport

Mon, 21 Jun 2021 00:00:00 +0000

Note) It’s just an English version of previous post .

Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.

In this article, I would like to give you a technical description of CVE-2020–15702 which is published recently. I discovered this vulnerability and reported it to the vendor via the Zero Day Initiative . This article is not intended to inform you of the dangers of vulnerabilities, but to share tips from a technical point of view.

CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring

Mon, 21 Jun 2021 00:00:00 +0000

Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.

In this article, I would like to give you a technical description of CVE-2021–20226( ZDI-2021–001 ) which is published before. I discovered this vulnerability and reported it to the vendor via the Zero Day Initiative. This article is not intended to inform you of the dangers of vulnerabilities, but to share tips from a technical point of view.

An overview of the vulnerabilities and attack methods can be found at the links below. This blog will explain in a little more detail.