Ali Firas (thesmartshadow)
Ali Firas (thesmartshadow)
Open-Source Security Researcher
Source-code auditing · vulnerability discovery · upstream remediation
I investigate the point where a system's security assumptions diverge from its actual behavior. My work follows that gap from a minimal reproducer to a patch, regression coverage, advisory, and release.
Website · GitHub · Security advisories · HackerOne · LinkedIn · X · Instagram
trace the boundary → reproduce the failure → repair the invariant → verify the release
Research profile
I audit open-source software with an emphasis on trust boundaries: the places where authorization, path ownership, parser state, memory layout, or resource limits are assumed rather than enforced.
My reports are built to be acted on. I aim to provide a realistic reproducer, affected-version analysis, a precise root cause, and a practical remediation. When appropriate, I write the patch and regression tests and continue tracking the issue through release and downstream adoption.
Public technical material is released after coordination or when the applicable disclosure process permits it.
Research map
| Boundary under review | Representative work |
|---|---|
| Authorization and tenant isolation | CISA manage.get.gov · RustFS · Microsoft UFO |
| Filesystem containment and ownership | RubyGems · Google zx · Microsoft APM · Microsoft AVML · miniserve |
| Memory and native-interface safety | libheif · rust-openssl · Zen C |
| Parsers and resource accounting | CoreDNS · PyJWT · cilium/ebpf · jq · xmldom · basic-ftp |
| Shared state and command construction | Hono · systeminformation |
Selected case files
| Project | Finding and outcome |
|---|---|
| CISA manage.get.gov | Authorization - A view-only organization member could perform privileged member-management actions. Validated through the real application flow; fixed upstream and published as an 8.1 High advisory. GHSA-hfq4-89cf-8p8j · Fix PR #5049 |
| RubyGems | Filesystem boundary - A pre-existing symlink inside the extraction destination could redirect writes outside the intended directory. I authored the containment fix and regression coverage; shipped in RubyGems 4.0.13. CVE-2026-82455 · PR #9493 · Release |
| Google zx | Ownership invariant - Setup created an alias, a helper returned its resolved target, and cleanup treated that target as owned. I worked on the upstream correction that restored the API contract. CVE-2025-13437 · PR #1349 |
| libheif | Memory safety - Mismatched auxiliary alpha-plane dimensions caused the encoder to size output from one image while copying data using another plane's dimensions, resulting in a heap out-of-bounds write. Fixed in 1.23.1. CVE-2026-62291 · GHSA-xpw3-9rhw-482x |
| rust-openssl | Cryptographic binding - Non-aligned AES key-wrap-with-padding input could make OpenSSL write beyond the caller-provided in-place buffer. The affected method had been missed by an earlier security fix; corrected in crate version 0.10.80. CVE-2026-45784 · GHSA-phqj-4mhp-q6mq |
| jq | Policy / path resolution - Embedded NUL bytes let a policy layer approve one logical import name while jq resolved and opened another local module or data file. Fixed in jq 1.8.2 and tracked by major distributions. CVE-2026-43895 · GHSA-7q7g-mrq3-phxr |
| CoreDNS | Resource accounting - The DNS-over-HTTPS GET path performed expensive parsing, Base64 decoding, and message processing before rejecting oversized input. The remote unauthenticated denial of service was fixed in CoreDNS 1.14.3. CVE-2026-32936 · GHSA-63cw-r7xf-jmwr · GO-2026-5164 |
| Rack | Output encoding - Attacker-controlled filenames reached Rack::Directory output without safe handling, enabling stored XSS. The fix shipped across supported branches and reached Ubuntu, Debian, and SUSE security updates. CVE-2026-25500 · GHSA-whrj-4476-wvmp · Ubuntu · Debian |
Selected writing
The Alias Was Ours. The Target Wasn't
Google zx · CVE-2025-13437 · ownership semantics
The vulnerability was not simply “a symlink bug.” It came from a broken ownership contract: setup created an alias, a helper returned the resolved target, and cleanup deleted the target as though it owned it. The first patch contained the exploit; the second repaired the API contract at its source.
Upstream remediation
Security research is most valuable when the corrected invariant survives the next refactor. These are patches I authored and contributed to projects outside my own account:
| Upstream change | Security property restored |
|---|---|
| RubyGems #9493 | Confines extraction when destination paths contain pre-existing symlinks; released in RubyGems 4.0.13. |
| CEL-Go #1302 | Enforces expression-size limits before source-buffer allocation, with regression and allocation tests. |
| Google zx #1349 | Prevents cleanup from deleting an external node_modules directory; later published as CVE-2025-13437. |
| Ruby JSON #948 | Rejects negative generator depth before native hangs or crashes. |
| Google HumanIO #4 | Stops source-file exposure and moves a hard-coded service token to environment configuration. |
| httparse #217 | Documents strict limits for repeated parsing of growing partial buffers. |
Research record
Published CVE record - 25 entries
2026
| Record | Project |
|---|---|
| CVE-2026-82457 | su-exec |
| CVE-2026-82455 | RubyGems |
| CVE-2026-62291 | libheif |
| CVE-2026-61371 | Microsoft AVML |
| CVE-2026-59896 | Hono |
| CVE-2026-54568 | Microsoft UFO |
| CVE-2026-48525 | PyJWT |
| CVE-2026-45784 | rust-openssl |
| CVE-2026-45539 | Microsoft APM |
| CVE-2026-44724 | systeminformation |
| CVE-2026-44240 | basic-ftp |
| CVE-2026-43895 | jq |
| CVE-2026-39360 | RustFS |
| CVE-2026-34601 | xmldom |
| CVE-2026-33491 | Zen C |
| CVE-2026-32936 | CoreDNS |
| CVE-2026-32808 | pyLoad |
| CVE-2026-25500 | Rack |
| CVE-2026-10722 | cilium/ebpf |
2025
| Record | Project |
|---|---|
| CVE-2025-67125 | docopt.cpp |
| CVE-2025-67124 | miniserve |
| CVE-2025-63095 | Tempus Ex hello-video-codec |
| CVE-2025-59717 | DigitalOcean do-markdownit |
| CVE-2025-59716 | ownCloud Guests |
| CVE-2025-13437 | Google zx |
Additional investigations and technical references
- PyJWT - Unauthenticated resource-consumption amplification in detached JWS processing; fixed in 2.13.0. CVE-2026-48525 · GHSA-w7vc-732c-9m39
- Hono - Cross-request context leakage caused by shared mutable JSX state; fixed in 4.12.27. CVE-2026-59896 · GHSA-hvrm-45r6-mjfj
- xmldom - XML injection through unsafe CDATA serialization; fixed across two maintained release lines. CVE-2026-34601 · GHSA-wh4c-j3r5-mjhp
- Zen C - Stack-based buffer overflow in compiler identifier mangling; fixed in 0.4.4. CVE-2026-33491 · GHSA-rv74-w6q7-h8xr
- basic-ftp - Unbounded multiline-response accumulation from a malicious or compromised FTP server; fixed in 5.3.1. CVE-2026-44240 · GHSA-rpmf-866q-6p89
- Microsoft UFO - Missing authorization allowed an authenticated device client to request another device's stored system information. CVE-2026-54568 · GHSA-hc27-j4p9-qm2x
- pyLoad - Arbitrary file deletion during encrypted 7z password verification; co-discovered with Ali Al-Akbar. CVE-2026-32808 · GHSA-7g4m-8hx2-4qh3
- Microsoft AVML - Symlink-following output creation with truncation before validation; fixed in 0.17.0. CVE-2026-61371 · Research reference · Fix PR #754
- cilium/ebpf - Malformed BTF input could trigger parser panics; fixed with upstream boundary checks. CVE-2026-10722 · Issue #2019 · Fix PR #2021
- miniserve - Upload finalization was affected by a TOCTOU and symlink race outside the intended root. CVE-2025-67124 · GHSA-mxc8-4jqf-368q
- docopt.cpp - Signed counter overflow in repeated-option occurrence merging. CVE-2025-67125 · Research reference
- ownCloud Guests - Unauthenticated pending-guest enumeration through response differences in registration links. CVE-2025-59716 · Research reference
- DigitalOcean do-markdownit - Allow-list bypass through string-versus-array type confusion. CVE-2025-59717 · GHSA-2h8j-8r9p-849f
- Tempus Ex hello-video-codec - Crafted input could trigger denial of service in
BitstreamWriter::write_bits(). CVE-2025-63095 · Research reference
Method
I begin with the trust boundary rather than a scanner result. I trace how external data reaches authorization decisions, file operations, parsers, process execution, shared state, cryptographic buffers, and resource allocation. A promising condition is then reduced to the smallest realistic reproducer and tested across clean versions.
I keep technical validity separate from severity. Some results are vulnerabilities, some are defense-in-depth improvements, and some should remain ordinary bugs. The goal is evidence that maintainers can verify and a fix whose security property is explicit.
boundary → data flow → minimal reproducer → affected range → root cause → patch + regression → release
Current lines of inquiry
- Package managers, archives, and filesystem boundaries
- Authorization and multi-tenant isolation
- Parser state and malformed-input handling
- Memory safety across native and language boundaries
- Developer tools, AI tooling, and CI workflows
- Linux and systems software
- Supply-chain behavior and incomplete security fixes
Recognition and references
- Microsoft Security Response Center - Special Recognition
- Berkeley Lab - White Hats for Science VDP kudos
- GitHub Advisory Database - credited advisories
Elsewhere
This GitLab profile is a curated research index. My complete public repository history and primary research archive are maintained on GitHub; long-form analysis is published at thesmartshadow.dev.
For coordinated disclosure or open-source security collaboration:
- GitHub: @thesmartshadow
- Public case files: GitHub Gists
- HackerOne: thesmartshadow
- LinkedIn: Ali Firas
- X: @thesmartshadow_
- Instagram: @thesmartshadow
Personal projects
View allAbout
Security researcher focused on vulnerability research, source code auditing, and zero-day discovery. Mostly interested in bugs that start with one wrong assumption.