Simon Gerst

Germany

Simon is a security researcher at Asymmetric Research that loves tearing apart software to find security bugs. He wants to share his knowledge and also his CodeQL queries, to perform bug hunting at scale. He mostly finds bugs in OSS and contributes to the GitHub Security Lab Bug Bounty Program. In his free time he enjoys playing piano.

Community Contributions

LatestBlog postsOpen sourceSpeaking Event organizationForumOther

ESBMC maintainer

ESBMC is a bounded model checker that can be used to find (security) bugs in single- and multithreaded C/C++, CUDA, CHERI, Kotlin, Python, and Solidity programs. Bugs be bounds checks, overflow, use-after-free, but also user-defined assertions. I contributed 39 PRs/issues fixing some longstanding bugs and hunted down tricky issues by extensively using `creduce`/`cvise` to reduce test cases. I mostly simplified existing code and contributed new tests cases in 2025.

Open source project / 11-28-2025

What to Do When Creating Your CodeQL Database Fails – and How to Report the Perfect Reproducer Using cvise

I wrote a about debugging CodeQL database creation failures, identifying the root cause from build-tracer logs, and creating minimal reproducers using cvise.

Blogpost / 11-28-2025

CodeQL C/C++ extractor errors

I encountered a catastrophic error during the creation of a CodeQL C++ database on a huge project that would affect anyone that builds databases on modern ubuntu/libstdc++ versions. Using cvise, I was able to reduce the huge test case to just six lines, allowing the developers to easily reproduce and fix the issue.

Open source project / 10-14-2025

Attacking and defending GitHub Actions

I spoke about GitHub Actions and why they are a prime target for (supply-chain) attacks at SEC-T one of Sweden's biggest cyber security conference in Stockholm. Participants learned how to exploit and (also) fix old vulnerabilities, what new vulnerabilities to be aware of, and how to reduce the impact should your Actions get exploited.

Speaking (conference/usergroups) / 09-10-2025

Finding Bugs in V8: A Formal Verification Approach

I spoke about how JavaScript engines like V8 make code run super fast by using a lot of clever analysis to simplify the code. However, there have been a lot of security issues in V8, and many of them stem from bugs in this analysis. I explained how I used formal methods – a fancy way of saying "super thorough bug checking" – to poke around in V8's C++ code as I wanted to see if one could formally verify the type analysis/range analysis of the new Turboshaft JIT engine. I then presented the tools and techniques I built, including how I used the ESBMC model checker to put V8's range analysis functions under the microscope.

Speaking (conference/usergroups) / 09-04-2025

GPN CTF 23

I co-organized the GPN CTF 23 event, wrote five challenges, worked on infrastructure stuff and was responsible for sponsoring and overall coordination.

Event organization / 06-20-2025

CVE-2025-4949: XXE in JGit

While working on https://intrigus.org/research/2025/05/07/realworld-ctf-2024-using-codeql-to-find-bugs-in-codeql/ I accidentally found an XXE bug in JGit. The developers fixed the bug quickly and released a new version, making every user a bit more secure :)

Other / 05-12-2025

RealworldCTF 2024 – Protected-by-Java-SE – Writeup

I show how I solved a CTF challenge centered around GitHub's CodeQL software. Participants had to find an external entity injection (XXE) in CodeQL, but a friend and I found an unintended solution. Because it's fun, I then use CodeQL itself to find the bug in CodeQL.

Blogpost / 05-07-2025

Related Stars

Gina Häußge

foosel

Santosh Yadav

santoshyadavdev

Sebastián Ramírez

tiangolo

Monica Powell

m0nica