Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Worker permission bypass via InternalWorker leak in diagnosticsAnalysed#2575105	Valid	Access Control	High	2025-01-21	–	42
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grantAnalysed#3761342	Valid	Access Control	High	2026-07-29	–	33
setuid() does not drop all privileges due to io_uringAnalysed#2170226	Valid	Access Control	High	2024-03-16	–	24
Code injection and privilege escalation through Linux capabilitiesAnalysed#2237545	Valid	Access Control	High	2024-02-15	–	23
dns.resolve truncates names containing NUL charAnalysed#4038342	Valid	Access Control	High	2026-10-23	–	18
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Analysed#1632921	Valid	Access Control	High	2022-09-28	–	16
The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1#1877919	Valid	Access Control	High	2023-07-20	–	8
Permissions policies can be bypassed via process.mainModule#1747642	Valid	Access Control	High	2023-03-19	–	7
Process-based permissions can be bypassed with the "inspector" module.#1962701	Valid	Access Control	High	2023-07-20	–	6
DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)#1069487	Valid	Access Control	High	2021-02-23	$500	5

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.