🎯 New Report #3782701: Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
🔺Severity: Critical
👽 Reporter: griffinf
⭐️ Reputation: 1318
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 12000
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-08-05 15:50:21
📝 Summary: A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed it. This allowed an attacker to run arbitrary JavaScript in the context of the Node.js process, resulting in the exposure of sensitive information such as database credentials, deployment access tokens, and encryption keys.
📂 Report JSON File: 3782701
@hackeronereports