EIP-2026-119329

This exploit leverages a null byte injection vulnerability in Yaws web server to disclose the source code of script files. The attack involves appending a null byte (%00) to the URL, which bypasses file extension checks and forces the server to return the raw script content.