aviral srivastava

@aviralxroot

Offensive AI Security & Exploit Development

Sunnyvale, USAJoined March 2026

About

I explore the offensive side of cybersecurity through exploit research, AI security, and vulnerability discovery. Here, I document real bugs, attack paths, and technical deep dives into how modern software and AI systems fail.

Available for

Nothing here yet.

aviral srivastava's blogs

Offensive AI Exploitationaviraxroot.hashnode.dev3 posts

Articles Comments

Recently published

ASaviral srivastavaaviraxroot.hashnode.devMar 29 · 10 min read

I Found 5 Security Vulnerabilities in XGBoost. Here's What Happened.

XGBoost is one of the most important libraries in machine learning. 26,000+ GitHub stars. Used by banks for fraud detection, insurance companies for risk modeling, tech companies for ranking systems,

0

ASaviral srivastavaaviraxroot.hashnode.devMar 19 · 9 min read

CVE-2026-33017: How I Found an Unauthenticated RCE in Langflow by Reading the Code They Already Fixed

In early 2025, CISA added CVE-2025-3248 to their Known Exploited Vulnerabilities catalog. It was an unauthenticated remote code execution bug in Langflow, the popular open-source AI workflow builder w

0

ASaviral srivastavaaviraxroot.hashnode.devMar 16 · 13 min read

I Found a SQL Injection in an AI Agent. It Taught Me That We Broke the First Rule of Database Security.

I was two hours into auditing AnythingLLM when I stopped scrolling and stared at my screen for a good ten seconds. Not because the code was complex. Because it was the opposite. javascript getTableSch

0

aviral srivastava

About

Available for

aviral srivastava's blogs

Recently published

I Found 5 Security Vulnerabilities in XGBoost. Here's What Happened.

CVE-2026-33017: How I Found an Unauthenticated RCE in Langflow by Reading the Code They Already Fixed

I Found a SQL Injection in an AI Agent. It Taught Me That We Broke the First Rule of Database Security.

Search Hashnode

aviral srivastava

About

Available for

aviral srivastava's blogs

Recently published

I Found 5 Security Vulnerabilities in XGBoost. Here's What Happened.

CVE-2026-33017: How I Found an Unauthenticated RCE in Langflow by Reading the Code They Already Fixed

I Found a SQL Injection in an AI Agent. It Taught Me That We Broke the First Rule of Database Security.