Recent content on Hi, I am Nishant J.
Disclaimer: All opinions and views in this article are my own. When citing, please call me an Independent Security Researcher. The best security control in agent systems is often not a sandbox, a policy engine, or a classifier. It is a well-timed interruption. In AI systems, that interruption can be what breaks the exploit chain. Human-in-the-loop (HITL) works, but it also adds friction. As…
Disclaimer: This research was conducted strictly independent of my employer (excluded from scope). All opinions and views in this article are my own. When citing, please call me an Independent Security Researcher. 2025 Update: This research work resulted in 7-CVEs NPM package 3 talks & CTF TL;DR: I found some path traversal issues in open source projects! Introduction and Goal On May 02, 2024 CISA…
CVE Bug Software Severity Authored Fix CVE-2024-39918 Path Traversal @jmondi/url-to-png Medium (4.3) Yes CVE-2024-39919 SSRF @jmondi/url-to-png Low (3.1) Yes CVE-2024-57410 Path Traversal mirotalksfu Critical(10.0) No CVE-2024-43797 Path Traversal AudioBookShelf Medium(5.4) Yes CVE-2024-47769 Path Traversal Idurar CRM High(7.5) Yes CVE-2024-56198 Path Traversal Path-Sanitizer Critical(10.0) No…
My OSS Projects NPM | is-path-inside-secure NPM | spotlighting-datamarking NPM Package Blast Radius | OpenSecure OSS Project Contributions 2020: Helped build the brute force list for GraphQL in the largest list set used for security assessments, SecLists
My Talks Path Traversal Research | 2025 BlueTeamCon | September: Hunting Path Traversal in Open Source OWASP Boston | April: Hunting Path Traversal in Open Source: Fix > Find OWASP Denver | March: Hunting Path Traversal in OSS: Fix > Find BSidesSF | 2024: Getting over the finish line: Loom Security Journey
This was one of the winning entry for the CTF The challenge can be found here: https://challenge-0323.intigriti.io/ We are tasked with hacking the flag from the admin account. “The admin user has a note with the flag.” The authors also provide us with the source code for the CTF. Source Code review We are provided with the NodeJS application, with file-structure like so: 1├── README.md…
TL;DR I currently work as a Product Security Engineer at Atlassian (joined via Loom acquisition) Security intern at MakeMyTrip in 2021 and Tinder AppSec in 2022 → Loom in 2023 leading AppSec and bug bounty (no, seriously!). I disclosed vulnerabilities to GitHub, GitLab, Glassdoor, NerdWallet, Bill.com and more during my short lived bug bounty career. Currently retired; the habits persist.…