{"uuid": "00db4ae3-b6e8-400e-aca2-1a47bfcbe45f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1337", "type": "seen", "source": "https://gist.github.com/jeuvv/95e4e8744653a203e5d2973ee8ceb5e9", "content": "(()=>{\n  if(document.getElementById('mh-root')){document.getElementById('mh-root').remove();return}\n  const D=document, $=s=>D.querySelector(s);\n  D.head.insertAdjacentHTML('beforeend',`\n    #mh-root{position:fixed;top:10px;right:10px;width:330px;z-index:99999;font:12px \"Courier New\",monospace;background:#0a0a0a;border:1px solid #00ff41;box-shadow:0 0 24px rgba(0,255,65,.35);color:#00ff41}\n    .mh-hdr{display:flex;justify-content:space-between;align-items:center;padding:6px 9px;background:#111;border-bottom:1px solid currentColor;font-weight:700;letter-spacing:2px;font-size:10px}\n    .mh-x{background:none;border:1px solid currentColor;color:inherit;font:inherit;width:20px;height:20px;line-height:1;padding:0;margin-left:3px;cursor:pointer}\n    .mh-x:hover{background:#00ff41;color:#0a0a0a}\n    .mh-body{padding:9px}\n    .mh-meta{font-size:10px;opacity:.7;margin-bottom:7px;line-height:1.5}\n    .mh-term{background:#000;border:1px solid currentColor;height:92px;overflow:auto;padding:5px;font-size:10px;white-space:pre-wrap;word-break:break-all;margin-bottom:8px}\n    .mh-bar{width:100%;height:12px;background:#000;border:1px solid currentColor;margin-bottom:8px}\n    .mh-fill{height:100%;background:#00ff41;width:0;transition:width .1s linear}\n    .mh-grid{display:grid;grid-template-columns:1fr 1fr;gap:5px}\n    .mh-btn{background:#111;border:1px solid currentColor;color:inherit;padding:7px;font-family:inherit;font-size:11px;cursor:pointer;text-transform:uppercase;letter-spacing:1px}\n    .mh-btn:hover{background:#00ff41;color:#0a0a0a}\n    .mh-btn:active{transform:scale(.96)}\n    .mh-gib{grid-column:span 2;border-color:#ff0040;color:#ff0040;font-weight:700;letter-spacing:3px;animation:mh-pulse 1.2s infinite}\n    @keyframes mh-pulse{50%{box-shadow:0 0 18px rgba(255,0,64,.9)}}\n  `);\n  D.body.insertAdjacentHTML('beforeend',`\n\n    \n\u2b24 SECRET // MASTERHACKER v6.9\n      _\u2715\n    \n    \n\n      \nCLEARANCE: COSMIC TOP SECRETOPERATOR: u/1337h4x0rIP: 127.0.0.1CVE: CVE-2026-1337\n      \n\n      \n\n\n      \n\n        DDoS\n        SQLi\n        Brute\n        RShell\n        Netstat\n        Skid\n        \ud83d\udd13 HACK THE GIBSON\n      \n      \nrockyou.txt \u2022 14,341,564 passwords\n    \n  `);\n\n  const T=$('#mh-T'), F=$('#mh-P');\n  let AC=null, muted=false, tick=null;\n  const rnd=(a,b)=>Math.floor(Math.random()*(b-a))+a;\n  const ip=()=>[0,0,0,0].map(()=>rnd(0,256)).join('.');\n\n  const log=(t,c)=>{const l=D.createElement('div');l.style.color=c||'#00ff41';l.textContent='> '+t;l.style.opacity=0;l.animate?.([{opacity:0},{opacity:1}],{duration:250,fill:'forwards'});T.appendChild(l);T.scrollTop=T.scrollHeight};\n  const beep=(f,d,y)=>{if(muted)return;try{AC=AC||new(AudioContext||webkitAudioContext);const o=AC.createOscillator(),g=AC.createGain();o.type=y||'square';o.frequency.value=f;g.gain.value=.04;o.connect(g);g.connect(AC.destination);o.start();o.stop(AC.currentTime+d)}catch(e){}};\n  const prog=(ms,cb)=>{let n=0;clearInterval(tick);tick=setInterval(()=>{n+=Math.random()*4+1;if(n>=100){n=100;clearInterval(tick);cb?.()}F.style.width=n+'%'},ms/40)};\n  const skid=()=>{const o=D.createElement('div');Object.assign(o.style,{position:'fixed',inset:0,display:'flex',alignItems:'center',justifyContent:'center',font:'700 90px \"Courier New\",monospace',color:'rgba(255,0,64,.18)',letterSpacing:'20px',transform:'rotate(-30deg)',pointerEvents:'none',zIndex:99998});o.textContent='SCRIPT KIDDIE';D.body.appendChild(o);setTimeout(()=>o.remove(),3000)};\n\n  const EX=[\n    ()=>{log('DDoS on '+ip());beep(200,.1,'sawtooth');setTimeout(()=>log('SYN flood sent. Packets: 133337'),400);setTimeout(()=>log('SKIDS DETECTED','#ff0040'),800);setTimeout(()=>log('Target uptime: 0%'),1200)},\n    ()=>{log(\"Testing ' OR 1=1 --\");beep(600,.06);setTimeout(()=>log('SQL syntax error','#ff0040'),500);setTimeout(()=>log('UNION SELECT ... 4200 cards exfiltrated.'),1100)},\n    ()=>{log('rockyou.txt loaded. 14,341,564 passwords.');beep(400,.05);setTimeout(()=>log('trying: hunter2'),300);setTimeout(()=>log('trying: correct-horse-battery-staple'),700);setTimeout(()=>log('CRACKED: iloveyou'),1100)},\n    ()=>{log('Reverse shell on :4444');beep(900,.08,'sine');setTimeout(()=>log('bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'),500);setTimeout(()=>log('whoami: root. Persistence via crontab.'),1000)},\n    ()=>{log('netstat -an | find \"ESTABLISHED\"');beep(500,.05);setTimeout(()=>log('connecting battle.net:1119 ... bypassing Warden'),400);setTimeout(()=>log('Account hacked. Enjoy your ban.'),1000)},\n    ()=>{log('SKID FILTER ACTIVATED','#ff0040');beep(100,.3,'sawtooth');skid();setTimeout(()=>log('Skid neutralized. Proceed.'),1500)},\n    ()=>{log('INITIATING GIBSON BREACH','#ff0040');beep(1000,.15,'sawtooth');prog(2600,()=>{log('MAINFRAME ACCESS GRANTED','#fff');beep(1200,.2,'sine');setTimeout(()=>{log('Exfiltrating 4.2 TB...');prog(1600,()=>{log('GIBSON OWNED','#ff0040');beep(80,.5,'sawtooth');setTimeout(()=>log('Session terminated. Cover blown.','#ff0040'),3000)})},1200)})}\n  ];\n\n  $('#mh-root').addEventListener('click',e=>{\n    const b=e.target.closest('button'); if(!b) return;\n    if(b.dataset.x!==undefined){\n      if(b.dataset.x==='1') $('#mh-root').remove();\n      else{const d=$('.mh-body');d.style.display=d.style.display==='none'?'':'none'}\n    } else if(b.dataset.a!==undefined) EX[+b.dataset.a]();\n  });\n\n  log('Establishing secure connection...'); beep(600,.05);\n  setTimeout(()=>log('Tunneling through 7 proxies...'),300);\n  setTimeout(()=>log('TOR exit node: '+ip()),600);\n  setTimeout(()=>log('READY. Select exploit or HACK THE GIBSON.'),1000);\n})();", "creation_timestamp": "2026-09-19T08:27:11.917274Z"}