Every vulnerability leaves a trail.
We run Lachesis against vulnerable historical code, then show the path it found from attacker-controlled input to the unsafe operation.
“The CVE was already known. The question was whether Lachesis could reconstruct why it happened.”
Known vulnerabilities. Fresh runs. The evidence stays visible.
↓Start with a case.
rsync: Off-by-one out-of-bounds heap write
The argv pointer array is allocated with `maxargs` elements. argc is grown through the loop -- by direct argv[argc++] stores and by the interprocedural glob_expand paths -- while the only in-loop realloc guard fires on `argc == maxargs-1`. After the loop, `argv[argc] = NULL;` writes the trailing terminator; when argc has reached maxargs, that store lands one 8-byte pointer past the allocation, corrupting adjacent heap.
wolfssl: Stack-based buffer overflow
An attacker-sized ASN.1 OID length is copied straight into a small fixed stack buffer with no size check, overflowing the stack.
mikro-orm: Query injection in mikro-orm QueryBuilderHelper
QueryBuilderHelper builds WHERE/identifier clauses from operator/field input; a crafted key or operator escapes the intended parameterization and is concatenated into the SQL, letting request-derived content alter the query -- SQL injection. The blind enumerator built the scope cleanly (25397 nodes / 76329 edges, 3978 sinks); class-matched candidates fired 3 time(s) (census {'injection.query.escaping': 3}) but all in sibling files, 0 in QueryBuilderHelper.ts. Sites: injection.query.escaping SchemaHelper.ts:219; injection.query.escaping MySqlSchemaHelper.ts:262; injection.query.escaping SchemaHelper.ts:217 The real defect in QueryBuilderHelper (condition/identifier processing) (QueryBuilderHelper.ts) was not surfaced. Upstream fix: the fixed release validates/parameterizes the identifier and operator handling so a crafted key cannot inject SQL.
History gives us the target.
Lachesis finds the path.
We choose a known vulnerable release, run Lachesis on that code, and preserve the queries, output, and source locations that form the result.
Each case clearly separates what was known from public history and what the Lachesis run established.