Sign InContact sales
Sign InContact sales

Kaveh.c: a new C challenge built from Broccoli2Shell (Node2Shell)

News··1 min read

Kaveh.c: a new C challenge built from Broccoli2Shell (Node2Shell)

Kaveh.c is a new C challenge on SecDim Play. The vulnerability is an unchecked return value (CWE-252). Your job is to find it and fix it.

We built Kaveh.c from Broccoli2Shell (CVE-2026-111497), also known as Node2Shell. It is a vulnerability in the Brotli library, which is written in C and used by Node.js.

The Brotli bug allows the code to write past the end of a buffer. This can crash the program, leak memory, or let an attacker run their own code.

Finding and fixing this flaw yourself teaches you to look at what the code does after a check fails.

Can you identify and fix the flaw?

:backhand_index_pointing_right: Play it on SecDim Play: Play - SecDim

Questions or comments? Discuss this post on SecDim Community →

Try it yourself

Find, Hack and Fix Your First Vulnerability

Reading about security bugs is one thing — fixing one is how the skill sticks. Play a free challenge from the wargame, no setup required.

Try a Challenge

Training for your team? Book a demo →