Hacker News Reader

Nice article. I wrote that lua "wrapper" 2 years ago. I used math.js to avoid RCE on bots, turns out math.js API is vulnerable but doesn't affect the wrapper.

View on HN

Did you also write the gnuplot plugin? Because that's also vulnerable, as found by the same @denysvitali: https://github.com/LucentW/s-uzzbot/issues/9

Proof: http://i.imgur.com/BpLtg0b.png

That was from @francesco-p (he renammed his account from psykomantis) https://github.com/yagop/telegram-bot/commit/89b92b4cbf81ce1... its in my repo but disabled by default.

Reply on news.ycombinator.com