The exploit depends on changing the config to execute a .rb file. And the config... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		KingOfCoders 4 months ago \| parent \| context \| favorite \| on: How we exploited CodeRabbit: From simple PR to RCE... The exploit depends on changing the config to execute a .rb file. And the config was supplied by a PR.

flexagoon 4 months ago [–]

Yes, but the exploit grants you access to ALL repos, not just the one the PR is in. You could just as well change the config in your own private repo and run coderabbit in it.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact