Kudelski Security Research

This blog post details how we exploited vulnerabilities in CodeRabbit, an AI code review tool, leading to remote code execution and access to 1 million repositories. It aims to educate on security issues and promote better practices.

The vulnerability in CodeRabbit allowed execution of malicious code despite warnings. One user noted, "What a bizarre world we're living in," highlighting the irony of automated security alerts failing during an exploit.

Another recurring theme in the discussion was the concern over transparency and communication from security vendors. Another user expressed, "I cancelled my coderabbit paid subscription," reflecting frustration over the lack of acknowledgment regarding the vulnerability.