HackerOne Disclosed Reports - 2026-10-13

High
resolved

CVE-2026-92392: HTTP/2 upload Use-After-Free

Bug reported by Luna was disclosed at October 14, 2026, 6:40 am   |   Use After Free

High
resolved

RCE in AWS Amplify CLI via Prototype Chain Traversal in amplify-velocity-template

Bug reported by Mattéo was disclosed at October 13, 2026, 5:25 pm   |   Code Injection

A remote code execution vulnerability was discovered in a template rendering library used by a cloud development framework. The vulnerability existed in the property resolution mechanism, which lacked filtering for prototype chain traversal. This allowed attackers who controlled template files to access the Function constructor and execute arbitrary operating system commands. The affected library was maintained by a cloud provider and used by approximately 60,000 developers weekly. The vulnerability could be exploited through malicious template files that appeared as legitimate resolver configurations while silently executing code during local development environments. No prototype chain guards were implemented in the codebase, unlike upstream versions which had added such protections in earlier releases.