// wall of bugs caught
15 critical bugs
PullLight would have caught in your PRs.
Every card below is a real bug flagged during PR review — CVEs, CWEs, before/after code. No competitors have a page like this. Try it on your own PR →
19
Total catches
15
Critical
4
High
15
CVSS ≥ 9
6
Languages
critical
# injection
Go
CVE-2025-20868
Arbitrary File Read via pct-decoding in JWT Claims Parsing
golang-jwt/jwt v3.3.0 and earlier parses the JWT `aud` claim using Go's net/url.Parse(), which interprets percent-encoded characters before path normalization. An attacker supplies `aud=%2f%2f..%2f..%2f%2fetc%2fpasswd` to read arbitrary server-side files accessible to the Go process.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
parsed, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, &jwt.StandardClaims{
Audience: attackerInput, // parsed by net/url.Parse() — path traversal in URL
})
After (fixed)
// AFTER (fixed)
parsed, _ := jwt.NewWithClaims(jwt.SigningMethodHS256, &jwt.StandardClaims{
Audience: urlParseClean(attackerInput), // normalize before parsing
})