#common vulnerability

← All posts

The One-Line Lie That Crashes Google's AI Compiler (a DoS in XLA)

I found a way to crash Google's AI compiler with a single malformed line of text - by handing it a description that contradicts itself. Instead of noticing, it believed both halves at once, then fell over. Let me explain in plain English. What is XLA? When you run a modern AI model - in TensorFlow, JAX, or the giant models behind today's chatbots - something has to turn that model into fast code for GPUs and TPUs. That something is XLA , Google's AI compiler. To do its job it reads an internal text format called HLO - think of it as the compiler's notebook. Engineers and tools pass HLO around as text all the time: to reproduce bugs, run tests, and feed the compiler work. And reading text from somewhere else is exactly where software tends to trip. The bug: two numbers that were allowed to disagree Big models don't fit on one chip, so XLA splits the work across many devices. The HLO text describes this using two separate pieces : a shape (say “2 by 2”...

Read →

Text Based Injection | Content Spoofing | Low Impact Common Web Vulnerability

Text Based Injection: Text injection or Text-Based Injection(TBI) is an injection in which user input is reflected as it is in the application response as plaintext. This is one of the ways to perform content spoofing also referred to as content injection or virtual defacement which can be used in phishing attacks. An application is vulnerable to Text injection when it does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value, or from the URL only that is reflected back to the user. The user will be presented with a modified page under the context of the trusted domain.  

Read →