Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAccess Control
- Any class
- Cross-site Scripting1
- Server-Side Request Forgery1
- Command and Code Injection6
- Injection and Smuggling21
- File and Path Handling7
- Memory Corruption19
- Race Conditions4
- Denial of Service25
- Input Validation and Logic2
- Misconfiguration and Insecure Design2
- Cryptography19
- Information Disclosure3
- Authentication2
- Access Control33
- Other weaknesses4
- No weakness recorded5
33 of 15,219 reports · $500 in bounties · 227 analysed so far
- #2084280ValidWASI sandbox escape via symlinkNode.js · Access Control · 2025 · Medium–44votes
- #2575105ValidWorker permission bypass via InternalWorker leak in diagnosticsNode.js · Access Control · 2025 · High–42votes
- #3815767ValidPermission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write pathsNode.js · Access Control · 2026 · Low–35votes
- #2079103ValidPermission model improperly processes UNC pathsNode.js · Access Control · 2024 · Low–35votes
- #3390084Validfs.futimes() Bypasses Read-Only Permission ModelNode.js · Access Control · 2026 · Low–34votes
- #3761342ValidPermission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grantNode.js · Access Control · 2026 · High–33votes
- #3692858ValidPermission Model Bypass via `process.report.writeReport()` Path MisvalidationNode.js · Access Control · 2026 · Low–29votes
- #2170226Validsetuid() does not drop all privileges due to io_uringNode.js · Access Control · 2024–24votes
- #2237545ValidCode injection and privilege escalation through Linux capabilitiesNode.js · Access Control · 2024–23votes
- #3838601ValidPermission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`Node.js · Access Control · 2026 · Low–21votes
- #2472071Validfs.fchown/fchmod bypasses permission modelNode.js · Access Control · 2024 · Low–20votes
- #2260337InformativePermissions can be bypassed via arbitrary code execution through abusing libuv signal pipesNode.js · Access Control · 2024–20votes
- #2257156ValidImproper handling of wildcards in --allow-fs-read and --allow-fs-writeNode.js · Access Control · 2024–20votes
- #4038342Validdns.resolve truncates names containing NUL charNode.js · Access Control · 2026 · High–18votes
- #2145862Validfs.lstat bypasses permission modelNode.js · Access Control · 2024 · Low–18votes
- #2092749ValidBypass network import restriction via data URLNode.js · Access Control · 2024 · Medium–18votes
- #1632921ValidDNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Node.js · Access Control · 2022–16votes
- #3838675ValidPermission Model bypass with fs.realpathSyncNode.js · Access Control · 2026 · Low–15votes
- #3559715ValidNode.js Permission Model bypass: UDS server bind/listen works without `--allow-net`Node.js · Access Control · 2026 · Medium–10votes
- #1211160ValidNode Installer Local Privilege EscalationNode.js · Access Control · 2021–10votes
- #3618831ValidUnix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)Node.js · Access Control · 2026 · Low–8votes
- #1877919ValidThe use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1Node.js · Access Control · 2023–8votes
- #3656869ValidUppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matchingNode.js · Access Control · 2026 · Medium–7votes
- #3449392ValidCVE-2024-36137 Patch Bypass - FileHandle.chmod/chownNode.js · Access Control · 2026 · Low–7votes
- #1747642ValidPermissions policies can be bypassed via process.mainModuleNode.js · Access Control · 2023–7votes
- #3996423ValidPermission Model filesystem over-grant via wildcard radix lookupNode.js · Access Control · 2026 · Low–6votes
- #1966492Validfs.openAsBlob() bypasses permission systemNode.js · Access Control · 2023–6votes
- #1962701ValidProcess-based permissions can be bypassed with the "inspector" module.Node.js · Access Control · 2023–6votes
- #1966499Validfs module's file watching is not restricted by --allow-fs-readNode.js · Access Control · 2023–5votes
- #1069487ValidDNS rebinding in --inspect (insufficient fix of CVE-2018-7160)Node.js · Access Control · 2021$5005votes
- #3656716ValidEmbedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindingsNode.js · Access Control · 2026 · Medium–4votes
- #3625987ValidPermission Model bypass via FileHandle.utimes() in the promises APINode.js · Access Control · 2026 · Low–4votes
- #1954535ValidOpenSSL engines can be used to bypass and/or disable the permission modelNode.js · Access Control · 2023–4votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.