# eqstlab/cve-2026-94545 architecture

> Architecture diagram of the GitHub repository eqstlab/cve-2026-94545, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/eqstlab/cve-2026-94545
- Repository: https://github.com/eqstlab/cve-2026-94545

## Overview

This repository is a vulnerable Next.js reproduction and a proof-of-concept client. The principal workflow is an unauthenticated request to `/api/og`: the route reads query or body text, embeds it in SVG rendered by `ImageResponse`, and—on the documented Node.js plus sharp path—passes it through native rasterization. The PoC builds an SVG/XInclude payload containing a ROP chain and sends it to that route; successful execution replaces the server worker with a command, with output returned out of band. The sampled route and exploit support these links; deeper framework and native internals are described in the README, not sampled source.

Main entry points: [`exploit.py`](https://github.com/eqstlab/cve-2026-94545/blob/main/exploit.py) (PoC orchestrator), [`app/app/api/og/route.jsx`](https://github.com/eqstlab/cve-2026-94545/blob/main/app/app/api/og/route.jsx) (OG image route)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_victim["Victim app"]
  node_homepage["Demo homepage<br/>[page.jsx]"]
  node_og_route["OG image route<br/>[route.jsx]"]
end

subgraph group_rendering["Render and execution"]
  node_image_response["ImageResponse"]
  node_sharp_native["Sharp native rasterizer"]
  node_native_parser["SVG native parsers"]
  node_execve["Command execution"]
end

subgraph group_poc["Exploit client"]
  node_exploit_main["PoC orchestrator<br/>[exploit.py]"]
  node_payload_builder["Payload and ROP builder<br/>[exploit.py]"]
  node_http_sender["HTTP payload sender<br/>[exploit.py]"]
end

node_requester(("Unauthenticated requester"))
node_listener["Netcat listener"]
node_command["Chosen shell command"]

node_requester -->|"sends GET or POST"| node_og_route
node_og_route -->|"renders SVG"| node_image_response
node_image_response -->|"rasterizes with sharp"| node_sharp_native
node_sharp_native -->|"uses native SVG stack"| node_native_parser
node_native_parser -->|"exploits parser"| node_execve
node_exploit_main -->|"builds payload"| node_payload_builder
node_payload_builder -->|"returns payload"| node_exploit_main
node_exploit_main -->|"sends payload"| node_http_sender
node_http_sender -->|"POSTs SVG text"| node_og_route
node_exploit_main -.->|"starts optionally"| node_listener
node_execve -->|"runs"| node_command
node_command -.->|"connects out of band"| node_listener

click node_homepage "https://github.com/eqstlab/cve-2026-94545/blob/main/app/app/page.jsx"
click node_og_route "https://github.com/eqstlab/cve-2026-94545/blob/main/app/app/api/og/route.jsx"
click node_exploit_main "https://github.com/eqstlab/cve-2026-94545/blob/main/exploit.py"
click node_payload_builder "https://github.com/eqstlab/cve-2026-94545/blob/main/exploit.py"
click node_http_sender "https://github.com/eqstlab/cve-2026-94545/blob/main/exploit.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_homepage,node_og_route toneBlue
class node_image_response,node_sharp_native,node_native_parser,node_execve toneAmber
class node_exploit_main,node_payload_builder,node_http_sender,node_requester toneMint
class node_listener,node_command toneIndigo
```

## Components

### Victim app

- [Demo homepage](https://github.com/eqstlab/cve-2026-94545/blob/main/app/app/page.jsx): `app/app/page.jsx`
- [OG image route](https://github.com/eqstlab/cve-2026-94545/blob/main/app/app/api/og/route.jsx): `app/app/api/og/route.jsx`

### Render and execution

- **ImageResponse**
- **Sharp native rasterizer**
- **SVG native parsers**
- **Command execution**

### Exploit client

- [PoC orchestrator](https://github.com/eqstlab/cve-2026-94545/blob/main/exploit.py): `exploit.py`
- [Payload and ROP builder](https://github.com/eqstlab/cve-2026-94545/blob/main/exploit.py): `exploit.py`
- [HTTP payload sender](https://github.com/eqstlab/cve-2026-94545/blob/main/exploit.py): `exploit.py`

### Other components

- **Unauthenticated requester**
- **Netcat listener**
- **Chosen shell command**

## Connections

- Unauthenticated requester → OG image route: sends GET or POST
- OG image route → ImageResponse: renders SVG
- ImageResponse → Sharp native rasterizer: rasterizes with sharp
- Sharp native rasterizer → SVG native parsers: uses native SVG stack
- SVG native parsers → Command execution: exploits parser
- PoC orchestrator → Payload and ROP builder: builds payload
- Payload and ROP builder → PoC orchestrator: returns payload
- PoC orchestrator → HTTP payload sender: sends payload
- HTTP payload sender → OG image route: POSTs SVG text
- PoC orchestrator → Netcat listener: starts optionally
- Command execution → Chosen shell command: runs
- Chosen shell command → Netcat listener: connects out of band