Vasco Franco
Summary: Trail of Bits researcher Vasco Franco published a June 17, 2025 post describing how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly produced high-impact security issues in production systems. The post covers three attack scenarios - marshaling and unmarshaling unexpected data, exploiting parser differentials, and data format confusion - through which attackers can bypass authentication, circumvent authorization controls, and exfiltrate sensitive data.
What you should know: The attack surface here is the parser itself, not the application logic: an attacker who can shape input to a Go JSON, XML, or YAML parser can bypass authentication and authorization controls without ever touching the code that enforces them.
Read the original at Trail of Bits Blog ↗
- Mentions
- CVE-2022-41042
- Related
- Escaping misconfigured VSCode extensions Cyber Risks ·Escaping well-configured VSCode extensions (for profit) Cyber Risks ·