# Parser disagreement bypasses integrity checks

Two components parse the same artifact differently, so a payload passes verification but executes

_Area: Software supply chain and CI/CD. Seen in 4 disclosed reports; one confirmed bounty: $10,000; latest 2026-03-27. Updated 2026-11-02._

## How it works
A verifier and a consumer both parse the same artifact, but disagree on what it says. The verifier's parser skips, reclassifies, or reinterprets a field that the consumer reads literally. The attacker crafts input that is benign to the verifier and malicious to the consumer, so the integrity check passes while the payload still runs. The root assumption that breaks: "if my parser accepts it, the downstream parser sees the same thing." That only holds if both parsers classify every byte identically.

## Where it shows up
- A review bot or scanner using a third-party parser (diff, pickle, archive, manifest) instead of the real loader [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-homebrew-security-incident-en.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md)
- Line-oriented regexes over multi-line formats where content lines can match metadata patterns (`+++ b/...`, `author ...`) [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-homebrew-security-incident-en.md)[E2](https://bugbountylibrary.com/r/blog%3Aiter-ca-post-gh-sig-pwn.md)
- Validators that silently skip lines they cannot match (empty fields, duplicate headers) [E2](https://bugbountylibrary.com/r/blog%3Aiter-ca-post-gh-sig-pwn.md)
- Per-file hash checks present but no aggregate/combined hash check against the advertised fingerprint [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md)
- Scanners that re-implement a format's parser and filter on opcodes/types rather than the semantic value the loader uses [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md)

## How to review
Identify both parsers and the exact field each trusts. The invariant: for every artifact the consumer accepts, the verifier must derive the same value for the security-relevant field (filepath, author, magic number, combined hash). Check that the verifier does not skip unmatched lines, does not let content lines overwrite metadata, and validates the aggregate hash the index advertises, not just per-file hashes [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md). For scanners, confirm they call the same loader or replicate its semantics exactly [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md).

## How finders spotted it
- After finding no leaked tokens, read CI workflows; review.yml looked airtight, but a GitHub issue about wrong changed-line counts prompted auditing the git_diff Gem's line-by-line regex, revealing filepath info could be overwritten by added content lines [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-homebrew-security-incident-en.md)
- Downloaded a GitHub Enterprise Server trial VM, deobfuscated the Ruby source, noticed the signing endpoint accepts raw commit data, and audited its author regex, spotting `.+?` cannot match a zero-length name [E2](https://bugbountylibrary.com/r/blog%3Aiter-ca-post-gh-sig-pwn.md)
- Code review of the simplestreams path: per-file SHA256 existed but the concatenated-hash-vs-index-fingerprint check was absent; confirmed with a malicious server [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md)
- Compared picklescan's get_magic_number() (pickletools.genops, INT/LONG only) against torch.load's pickle_module.load() [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md)

## Variants seen
- Diff parser reclassifies added content as file metadata, defeating a review bot [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-homebrew-security-incident-en.md)
- Regex skips a zero-length field, so a later attacker line is validated instead [E2](https://bugbountylibrary.com/r/blog%3Aiter-ca-post-gh-sig-pwn.md)
- Per-file integrity checked, aggregate fingerprint not [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md)
- Scanner filters opcodes while loader evaluates a value [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md)

## Impact and severity
Ranged from arbitrary Ruby execution on brew users via a malicious PR [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-homebrew-security-incident-en.md), to forging signed commits as any user [E2](https://bugbountylibrary.com/r/blog%3Aiter-ca-post-gh-sig-pwn.md), to cache poisoning that pivots one tenant's pull into cross-tenant code execution [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md), to RCE via a scanned model file [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md). Impact rose where the bypass reached shared infrastructure (caches, signing) or ran on common commands, not just install [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-homebrew-security-incident-en.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/lxc/incus/v6/client (go)** < 6.23.0, fixed in 6.23.0: Incus does not verify combined fingerprint when downloading images from simplestreams servers (CVE-2026-33542). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md. Fix: https://github.com/lxc/incus/commit/04e97418189f743411884afb81a3384e6218b8cd
- **picklescan (pip)** < 1.0.3, fixed in 1.0.3: Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER (CVE-2026-53875). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md. Fix: https://github.com/mmaitre314/picklescan/commit/b9997634683a4f4bd0c7e3701e7ce7e90fe70e8c

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-homebrew-security-incident-en.md
- E2: https://bugbountylibrary.com/r/blog%3Aiter-ca-post-gh-sig-pwn.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-97f8-7cmv-76j2.md