Developer Turns CVSS 10.0 RCE Exploit Script into Chrome Extension Using GitHub Copilot

·2 views

A security researcher revived a dormant 50-line Python proof-of-concept, originally written in December 2025 to fingerprint CVE-2025-55182, a critical unauthenticated Remote Code Execution vulnerability in React Server Components. Using GitHub Copilot as an architectural assistant, the developer spent 48 hours rebuilding the script into a Manifest V3 Chrome extension during the MLH Finish-Up-a-Thon hackathon. The upgraded tool, named RSC Fingerprint Detector, performs both passive and active reconnaissance to detect React Flight protocol vulnerabilities without triggering backend alerts. Key architectural improvements include IndexedDB-backed persistent telemetry, Shadow DOM isolation, and cross-context IPC, replacing the original synchronous, stateless design. GitHub Copilot played a central role in navigating Chrome's Content Security Policy restrictions and MV3 lifecycle constraints that had previously stalled the project.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Generative Engine Optimization: How to Make AI Tools Recommend Your Website

As users increasingly turn to AI tools like ChatGPT, Perplexity, and Google Gemini instead of traditional search engines, a new discipline called Generative Engine Optimization (GEO) is emerging to help websites gain visibility in AI-generated answers. Unlike conventional SEO, GEO requires content to be discoverable through Retrieval-Augmented Generation (RAG), the process by which AI systems perform live web searches and synthesize responses from top results. Technical factors are critical: AI crawlers allow only two seconds per page load and cannot execute client-side JavaScript, making server-side rendering or static site generation essential for AI visibility. Content structure also matters significantly, as AI models break pages into small chunks of roughly 128 tokens, and a study of 10,000 queries found that intentional structural changes can boost AI citation rates by up to 40%. Websites that fail to adapt risk being invisible to AI answer engines, which are rapidly reshaping how people discover information online.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a practice app learned to say 'we cannot tell yet' instead of faking progress

CogniPrep, a score-tracking practice platform, discovered that displaying trend arrows based on linear regression slopes was misleading users with false improvement or decline signals. With only 8–12 data points typical in practice sessions, the app found that statistical significance testing alone was insufficient — a result could be significant yet still indicate decline, not improvement. A separate performance bug was also uncovered where the same database query was being executed twice sequentially on every dashboard load, doubling Postgres round trips unnecessarily. The fix involved passing pre-fetched session data as an optional parameter to the analytics engine, eliminating the redundant query while keeping call sites flexible. The broader lesson highlighted is that Next.js fetch deduplication applies only to the React rendering path, not to API route handlers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Developer Builds Graph-Powered Agentic Fraud Investigation System at Hackathon

Developer Rohan Kumar, competing solo under team name BROTHERHOOD at Hacker House Goa '26, built an AI-driven fraud investigation agent as part of a TigerGraph challenge. The system uses TigerGraph's graph database to map relational connections between transactions, devices, cards, customers, and billing regions, treating fraud detection as an investigation workflow rather than a simple classification problem. Unlike conventional fraud models that flag individual suspicious transactions, the agent traverses connected evidence across the network, assesses uncertainty, and retrieves historical case context before recommending a next-best action. A policy engine sits between the evidence layer and the final decision, ensuring recommendations are grounded in structured data rather than LLM guesswork. The project includes a live dashboard, a public GitHub repository, and a demo video, with the core design principle being that the graph finds the evidence, the policy decides what to do with it, and the agent connects the two.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How one CSS media query handles mobile layout for all transactional emails

A developer at CogniPrep built a single HTML email shell function that wraps all transactional and campaign emails, accepting body rows and an unsubscribe URL as inputs. Because every content row is a direct child of the main card table, a single media query targeting .cp-card > tbody > tr > td is enough to adjust side padding for all emails on mobile screens under 600px. The use of child combinators instead of descendant selectors prevents the rule from bleeding into nested tables like score cards or buttons, preserving their individually set padding. The !important flag is intentional, not a shortcut, since inline styles dominate stylesheet rules in email clients and would otherwise override the media query. The template also handles preheader text — the inbox preview line — using four simultaneous hiding techniques and repeated zero-width spaces to stop email clients from appending unintended body copy to the preview.

0 comments Read more at DEV Community