/hunt-rce

name: hunt-rce
description: Hunting skill for remote code execution. Built from 1,218 public RCE bug bounty reports across HackerOne, Project Zero, Intigriti, GitHub Security Advisories, and curated awesome-* lists, plus 2024-2026 meta verified against NVD — React Server Components (CVE-2025-55182), runc Leaky Vessels (CVE-2024-21626), BentoML pickle (CVE-2025-27520/32375), LangChain REPL (CVE-2025-68613), Tekton git resolver (CVE-2026-40938), OpenProject git argument injection (CVE-2026-24685), ingress-nginx (CVE-2025-1974). Use when hunting RCE on web apps, OSS libraries, admin panels, file processors, CI/CD runners, GitOps controllers, K8s admission webhooks, container runtimes, ML inference servers, agentic LLM tools, or anywhere user input reaches a shell, deserializer, template engine, dynamic loader, or git/curl/tar CLI.
sources: hackerone_public, github_advisories, github_deep, project_zero, intigriti, devcore_blog, watchtowr, orca_security, microsoft_msrc, securitylab_github, nvd_verified
report_count: 1218
generated_at: 2026-05-04

Crown Jewel Targets

RCE is the highest-paying class in bug bounty, and the 24-month meta has shifted decisively toward five asset types. All CVEs below are verified against NVD.

**1. Modern JS framework deserialization (CVSS 10.0).** React Server Components / React Server Functions / Next.js App Router. **CVE-2025-55182** (CVSS 10.0, Meta Bug Bounty, Vercel WAF-bypass program on H1, exploited in the wild within 24 hours of disclosure) is the defining 2025-2026 RCE. Every Next.js >=14.3.0-canary.77 / >=15.x / >=16.x deployment running unpatched RSC is a one-request RCE target. Vercel maintains a *separate* H1 program paying low five-figure bounties for WAF bypasses against this CVE. Hunt this *first* on any modern JS stack.

**2. CI/CD runners and GitOps controllers.** GitHub Actions `pull_request_target` script injection, GitLab CI runner takeover, Jenkins script console, Tekton/ArgoCD/Flux git resolvers. **CVE-2026-40938** (Tekton git resolver `--upload-pack` argument injection — CVSS 9.4, NVD-verified, fix in v1.11.1) and **CVE-2026-24685** (OpenProject git argument injection in repository diff endpoint, CVSS 9.4) define the 2026 GitOps meta. CI compromise = supply-chain compromise; bounties scale accordingly. GitHub Security Lab pays for these directly; downstream programs (Cilium, ArgoCD, Tekton are all CNCF graduates) often have parallel bounty programs.

**3. Container runtimes and admission controllers.** **CVE-2024-21626** (runc "Leaky Vessels" — CISA KEV, CVSS 8.6, Snyk Labs disclosure) gives you full host RCE from any pod with `runc exec`. **CVE-2024-23653** (BuildKit GRPC SecurityMode missing privilege check) breaks out at build time. **CVE-2024-0132** (NVIDIA Container Toolkit TOCTOU, Wiz Research) covers the GPU-rich infrastructure stack. **CVE-2025-1974** (ingress-nginx admission controller RCE, CVSS 9.8) — any pod-network attacker reads cluster-wide Secrets. Hunt these on every Kubernetes target where you can deploy a pod.

**4. ML serving / inference platforms.** **CVE-2025-27520** (BentoML `deserialize_value()` unsafe pickle on `/summarize`, CVSS 9.8 critical, c2an1 disclosure via Snyk) and **CVE-2025-32375** (BentoML runner server, GHSA-7v4r-c989-xh26) demonstrate the universal pattern — model registries deserialize pickled tensors and trust the format. **CVE-2024-2912** (BentoML earlier pickle, Toreon disclosure). **CVE-2024-1560/1483/1594** (MLflow path traversal family, all via Huntr) reach arbitrary file read/write on the model server. Hunt model registry endpoints, inference servers, and `Content-Type: application/vnd.*+pickle` accepting handlers.

**5. Agentic LLM tool-use.** **CVE-2025-68613** (LangChain `langchain-experimental` PythonREPLTool / PandasDataFrameAgent — CVSS 9.8 critical, "Semantic RCE") is the new attack class. Indirect prompt injection in CSV/text/RAG context coerces the agent into writing exec()-able Python. Same pattern hits LlamaIndex code interpreter, MCP servers with shell tools, Ollama plugins. The agent is the gadget chain.

**6. Internet Bug Bounty / OSS supply chain.** `nodejs`, `curl`, `git`, `python`, `php`, `rails`, `marked`, `phpoffice/phpspreadsheet`, `GitPython`, `coredns`, `jackson-databind`, `log4j`, `snakeyaml`. A single bug here cascades downstream into thousands of apps. The 2026 corpus shows curl alone with multiple critical/high RCEs (`--engine` arbitrary library load via H1 disclosed report, short-flag grouping argument injection, SFTP QUOTE path traversal, libcurl cookie buffer overflow). Bounties scale with downstream blast radius.

**7. Government & enterprise asset surfaces (deptofdefense pattern).** Old log4j, Confluence (CVE-2023-22527 OGNL injection at `/template/aui/text-inline.vm`), Liferay (CVE-2020-7961), Pentaho with default creds, Cisco IOS XE, GlobalProtect (still paying via H1 disclosed 2025-2026) — all *still paying* on intranets and forgotten subdomains. Old CVEs against old assets is a paying strategy. Apache Tomcat **CVE-2024-50379** (write-enabled default servlet RCE via JSP race condition, CVSS 9.8) joined the rotation in 2024-2025.

**Admin panels with file/asset upload.** Anywhere ops staff upload images, configs, themes, packages. Screenshot URLs piped to shell, ZIP extraction without extension filter, theme installer running `unzip` then serving the public dir. Grav SSTI/direct-install (multiple Snyk advisories), WPML Twig SSTI (Patchstack disclosure).

**OAuth/SSO auth surfaces in OSS apps** — SAML signature validation that returns errors instead of throwing (Admidio H1 disclosed), TSIG bypass on gRPC/QUIC (CoreDNS GHSA), null-password fallback in OIDC (Note Mark GHSA). Not RCE alone, but the way INTO admin where RCE lives. Always-paired hunting target.

**File processors / parsers** — XLSX, XML, image (ExifTool), PDF, font parsers, archive extractors, anything that takes a file and runs code based on its content. Modern incidents hit phpspreadshee