# Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.

AI agent Neo found 22 CVEs across 13 OSS projects, including Budibase universal auth bypass, Crawl4AI exec() sandbox escape, and changedetection.io XPath file read.

- Payout: Research
- Severity: critical
- Program: Budibase
- Found by (vendor credit): Neo by ProjectDiscovery (https://neo.projectdiscovery.io)
- Disclosed: 2026-03-20
- CVE: CVE-2026-31816, CVE-2026-29039, CVE-2026-26216, CVE-2026-31975, CVE-2026-29065
- Write-up quality: 7/10
- Original: https://projectdiscovery.io/blog/everyone-is-finding-vulns-the-hard-part-is-proving-them
- Library page: https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them
- Tags: area:web domain:web impact:internal-access impact:rce kind:research platform:research sev:critical tech:nodejs tech:python technique:source-review vuln:access-control vuln:auth-bypass vuln:path-traversal vuln:rce

**Target:** Multiple OSS web apps (Budibase, changedetection.io, Crawl4AI, ClaudecodeUI)
**Root cause:** Multiple: regex auth exemption matched against full URL incl. query string (Budibase); XPath 3.0 unparsed-text() file access with no denylist (changedetection.io); exec() allowlist including __import__ (Crawl4AI); hardcoded JWT fallback + no per-message WS auth (ClaudecodeUI); zipfile.extractall() without path validation (changedetection.io).
**Steps:**
1. Budibase: `GET /api/ta_users/search?/webhooks/trigger` bypasses auth because WEBHOOK_ENDPOINTS regex tests full ctx.request.url
2. changedetection.io: set XPath filter to `xpath:unparsed-text('file:///etc/passwd')` and trigger check to read file inline
3. Crawl4AI: POST /crawl with hooks param containing Python code; exec() allowlist includes `__import__` enabling full stdlib import
4. ClaudecodeUI: forge JWT with fallback secret 'claude-ui-dev-secret-change-in-production', connect WebSocket shell, send commands (no per-message revalidation)
5. changedetection.io: POST crafted ZIP to /import with `../` member targeting changedetectionio/__init__.py for RCE
**How found:** Neo indexed codebases, mapped auth boundaries, then reasoned about runtime semantics: what ctx.request.url contains in Koa, what XPath 3.0 spec permits (unparsed-text), what __import__ enables inside exec(), and whether auth is enforced at every operation boundary rather than just implemented.
**Exploitation:** Budibase: bypass auth on all endpoints, escalate user to admin via PATCH /api/global/users, chain SSRF at /api/queries/import/info to reach CouchDB at couchdb-service:5984 and map internal Docker network. ClaudecodeUI: forged JWT + WS shell gives unauthenticated RCE. changedetection.io: Zip Slip writes arbitrary Python module, RCE on next import.
**Escalation:** Budibase auth bypass chained with SSRF to reach internal CouchDB and enumerate Docker network (worker 172.18.0.7, app .8, proxy .9). ClaudecodeUI chains three bugs (JWT fallback, platform mode bypass, no WS per-message auth) to unauthenticated RCE.
**Insight:** Check what a parser/library spec permits beyond the code pattern (XPath 3.0 unparsed-text, Python __import__ in exec allowlists); verify auth middleware matches only the path, not the full URL with query string; check whether WebSocket auth is revalidated per message, not just at handshake.

## Proof of concept (copied exactly from the original report)

**Budibase auth bypass via webhook regex in query string**

```
GET /api/ta_users/search → 401 Unauthorized
2GET /api/ta_users/search?/webhooks/trigger → 200 OK (full user list returned)
```

**changedetection.io XPath unparsed-text file read payload**

```
xpath:unparsed-text('file:///etc/passwd')

On any default changedetection.io instance (which ships with no authentication), creating a watch with this filter and triggering a check returns the file contents inline in the snapshot output.
```

## Write-ups of the same bug (oldest first)
- 2026-03-11: [@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection](https://bugbountylibrary.com/r/ghsa%3AGHSA-gv8f-wpm2-m5wr) — Ethan-Yang-opcia, DhiyaneshGeek, neo-ai-engineer
- 2026-03-20: [Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.](https://bugbountylibrary.com/r/blog%3Aprojectdiscovery-io-blog-everyone-is-finding-vulns-the-hard-part-is-proving-them) (this one)