Scripting languages are an essential part of many software environments. Common languages like Python, Ruby, or PHP power large parts of the modern web but bugs in their runtime environments allow attackers to break memory safety and sandboxing guarantees. A common bug class is callback bugs which happen when user-defined callbacks violate runtime invariants. For example, an object may be freed that is still in active use. These issues result in use-after-free, null pointer dereferences or type confusion.

Example of clearing a list while iterating through it:

class poc():
  def __eq__(self, other):
    l.clear()
    return NotImplemented
  l = [poc(), poc()]
3 in l

The check on the last line triggers a use-after-free as the l.clear() removed the elements in the array during the equal check. Such interactions between native implementations and user defined callbacks result in violations of the language level guarantees.

Triggering a callback bug requires a set of four preconditions that are satisfied: (i) control flow must reach a callback in the script, (ii) the callback must involve an attacker-controlled object, (iii) the callback must introduce unintended side effects such as freeing memory, and (iv) the native code must be unaware of the memory operation and then mishandles the affected object after the callback returns.

Our goal in this research is to establish a link between the script-side callbacks and their native-side invokers and to discover such bugs automatically. In CrossFit, we combine static analysis (to find interesting locations and patterns) with targeted fuzzing to trigger these bugs. CrossFit generates PoC scripts with custom classes and magic methods to demonstrate these vulnerabilities.

The key idea behind CrossFit is that we leverage context link analysis to bridge the gap between the script side and the runtime side. As these are different programming languages and contexts with different guarantees, we have to keep state at these different levels of abstraction. For each scripting language, we identify these callback invokers among their public API and then build our analysis on the LLVM IR level to handle the low level implementations transparently. Using this collected information, CrossFit then generates targeted scripts with PoC inputs to test the four conditions of callback bugs. This allows us to bias the generation towards scripts that are more likely to trigger interesting bugs.

In our evaluation on PHP, Python, and Ruby we discovered 21 new bugs and demonstrated that our targeted PoC generation can cover callback code and cross-language interactions more deeply. The full details are in the CrossFit paper and the source code are of course available.

This work is published at FSE'26 and thhe main credit of this work goes to Chibin Zhang who worked on the abstractions, refinement of the bug pattern, and design of the PoC generator.