Vulnerabilities
Google Dev Sites Expose RCE via Pickle Deserialization in Flask Session
Researcher Simon Koeck found that Google developer sites use a leaked secret to sign cookies containing unsafe pickle objects, enabling remote code execution.
Flask
Everything Payload Report has reported about Flask: 2 stories, newest first. Part of our Cyber Attacks coverage.
Cyber Attacks
Google DevSite Session Forgery Flaw Enabled Remote Code Execution
A flaw in Google’s DevSite platform allowed attackers to forge Flask sessions and run code on developer documentation sites before a fix was applied.