Trail of Bits open-sources a Claude Code skill to find hidden vulnerable Brotli copies (CVE-2026-111497)
banteg · x · 2026-10-24
Trail of Bits released brotli-checker, an open-source (MIT) scanner for the Node.js/Brotli vulnerability CVE-2026-111497, distributed as a Claude Code or Codex skill.
The tricky part, they say, is that it's surprisingly hard to tell whether you're even affected: Brotli decoder copies hide in dependencies, app packages, and stripped binaries. The skill scans source, dependencies, app packages, and unpacked container filesystems, fingerprints source and ELF binary code, investigates which copy the app actually uses, and guides the update.
More from coding & agent
- Jailbroken Kindle with KOReader + WeRead plugin beats modern e-readers, dev adds Obsidian sync — vista8 · 2026-10-24
- Same model, four coding harnesses: harness choice moved scores more than expected — Individual-Quote-958 · 2026-10-24
- Open-source Clairic Studio turns messy text into typed data and exports working code in 5 languages — dfinke · 2026-10-24
- How real teams run LLM evals in production: tools kept, tools dropped — LostLeek1304 · 2026-10-24
- Vibe coding with Opus 5.5: a Kanji learning dojo app with SRS, quizzes and stroke practice — Merzmensch · 2026-10-24
- Qwen 2.1 outpaint that only paints the sides: 100% pixel-true center, full workflow released — Environmental_Fan600 · 2026-10-24