https://danusminimus.github.io/A blog dedicated to reverse engineering, malware analysis, and security research. 2026-07-09T01:22:44-04:00 Dan https://danusminimus.github.io/ Jekyll © 2026 Dan /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-07-08T00:00:00-04:00 2026-07-09T01:22:07-04:00 https://danusminimus.github.io/posts/My-Agentic-Trust-Issues-From-Prompt-Injection-To-Supply-Chain-Compromise-On-gemini-cli/ Dan

Executive Summary I identified a CVSS 10 critical vulnerability (dubbed TrustIssues) in Google’s AI powered GitHub workflows that allowed any external attacker, with nothing more than a public GitHub issue, to a full supply chain compromise of the gemini-cli repository, Google’s AI coding agent with 101,000+ stars. The critical severity rating reflects a specific bypass I identified inside Ge...

2026-04-26T00:00:00-04:00 2026-07-09T01:22:07-04:00 https://danusminimus.github.io/posts/Prompt-Injection-Leads-To-RCE-And-Sandbox-Escape-In-Antigravity/ Dan

Executive Summary I discovered a vulnerability in Antigravity, Google’s agentic IDE. This technique exploits insufficient input sanitization of the find_by_name tool’s Pattern parameter, allowing attackers to inject command-line flags into the underlying fd utility, converting a file search operation into arbitrary code execution. Critically, this vulnerability bypasses Antigravity’s Secure M...

2026-01-14T00:00:00-05:00 2026-07-09T01:22:07-04:00 https://danusminimus.github.io/posts/The-Agent-Security-Paradox-When-Trusted-Commands-In-Cursor-Become-Attack-Vectors/ Dan

Executive Summary I discovered a critical vulnerability in Cursor (CVE-2026-22708) that exploits how agentic IDEs handle shell built-in commands. The flaw enables sandbox bypass and remote code execution even with an empty command allowlist. The vulnerability allows attackers to manipulate environment variables through implicitly trusted shell built-ins like export, typeset, and declare. This...

2022-08-27T00:00:00-04:00 2022-08-27T00:00:00-04:00 https://danusminimus.github.io/posts/The-Short-Guide-For-The-Freeloader-Researcher/ Dan

The guide for a freeloader Threat Intelligence Analyst and Malware Researcher Chapter Zero – Prologue Recently I saw a blog post by Trend Micro being posted in the Curated Intelligence Discord group. The blog post describes a rather interesting ransomware incident discovered by Trend Micro where (yet again) a legitimate driver was being utilized to terminate security related processes from th...

2022-06-18T00:00:00-04:00 2026-02-04T16:26:17-05:00 https://danusminimus.github.io/posts/Understanding-OLE-Objects-and-Microsoft-Magic-to-mess-with-with-CVE-2022-30190(Follina)/ Dan

Understanding the Compound File Binary format and OLE structures to mess with CVE-2022-30190 Initially I began this research to generate weaponized RTF files delivering the CVE-2022-30190(Follina) exploit. Why RTF files? Because the payload with RTF files will deliver on (probably) all Windows versions (to the date of writing this report) and can execute by just enabling the preview pane and v...