// /lib/creds · DECRYPTING RECOGNITION

CREDS // RECOGNITION

Recovered signals of recognition: Hall of Fame acknowledgements, published CVEs, and certifications. Every entry links to an independent source you can verify.

// HALL OF FAME

hall of fame

8 ON RECORD

// LETTERS OF RECOGNITION

letters of recognition

1 ON RECORD

NASA Letter of Recognition

open full PDF

// PUBLISHED CVEs

published cves

2 ON RECORD

CVE-2026-38360

CRITICAL · CVSS 9.8

Path Traversal → Remote Code Execution

Unauthenticated path traversal in dash-uploader's HTTP handler, where upload_id / resumableFilename reach os.path.join() & os.makedirs() unsanitized. A single POST with ../ writes files anywhere the process can; drop a .pth into site-packages and you get code execution on interpreter start.

Package: dash-uploader PyPI
Affected: ≥ 0.1.0, ≤ 0.7.0a2
Weakness: CWE-22 · Path Traversal
Disclosed: 2026
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD GHSA PoC

CVE-2026-38361

HIGH · CVSS 7.5

Uncontrolled Resource Consumption → Denial of Service

Unbounded file-upload handling (max_file_size) in dash-uploader lets an unauthenticated attacker exhaust resources and take the service down, with no auth and no user interaction.

Package: dash-uploader PyPI
Affected: v0.1.0 to v0.7.0a2
Weakness: CWE-400 · Resource Consumption
Disclosed: 2026
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H