Posted by Nir Yehoshua on Apr 29 Hi Full Disclosure list,

I published a technical research article titled:

When Trusted Tools Become Attack Primitives

The article examines how trusted local utilities can become

security-relevant primitives when used inside automated processing

pipelines.

It covers two case studies:

1. macOS textutil resolving remote resources during HTML-to-text

conversion.

2. KeePassXC KDBX-controlled KDF parameters creating significant...