Skip to content

Writeups

Security vulnerability writeups and research.

critical / n8n /

From a Schema Name to RCE in n8n

n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node. One request, full shell.

high / h3 /

One Uppercase Letter Breaks Every Nuxt App

h3 powers every Nuxt app but only recognized 'chunked' in lowercase. Send 'ChunKed' instead and you get request smuggling.

critical / Tolgee /

Reading /etc/passwd via Translation Upload in Tolgee

Tolgee's XML translation importers ship with zero security config. Upload a crafted file, read anything from the server. Confirmed on their cloud platform.