3 papers
cs.CR2026
zkSBOM: Privacy-Preserving SBOM Sharing with Zero-Knowledge Sets
Tom Sorger, Eric Cornelissen, Aman Sharma +3
Software Bills of Materials (SBOMs) are increasingly mandated by regulators, yet existing sharing mechanisms impose a binary choice between full disclosure and full opacity. This e…
cs.CR2025
NodeShield: Runtime Enforcement of Security-Enhanced SBOMs for Node.js
Eric Cornelissen, Musard Balliu
The software supply chain is an increasingly common attack vector for malicious actors. The Node.js ecosystem has been subject to a wide array of attacks, likely due to its size an…
cs.CR2024
GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes
Eric Cornelissen, Mikhail Shcherbakov, Musard Balliu
Prototype pollution is a recent vulnerability that affects JavaScript code, leading to high impact attacks such as arbitrary code execution. The vulnerability is rooted in JavaScri…