{
  "id": 13988957,
  "title": "Finding a $90,000 Remote Code Execution Vulnerability in Google",
  "url": "https://urgent.news/2026/10/12/finding-a-90-000-remote-code-execution-vulnerability-in-google",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-12T14:40:35.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce"
  },
  "original_language": "en",
  "account": "A remote code execution (RCE) vulnerability was discovered in Google's OAuth flow. The flaw lies in the session cookie used for the OAuth flow. The cookie is made up of a Flask session payload containing a timestamp and signature. Initially, the cookie appeared to be 1,200 bytes long, more than enough for a CSRF token and return URL. Upon decoding the cookie, it was revealed to be zlib-compressed. Further decoding yielded a pickle object. This pickle object contained the client_id and client_secret of Google's OAuth client. An attacker could reuse the leaked client secret as the Flask SECRET_KEY, leading to a successful signature verification. The attacker was able to forge a valid cookie, allowing them to set arbitrary keys and values in the session. The server then unpickles the payload, which can execute arbitrary code. The vulnerability exposes a public signing key and a sink that can be manipulated for unauthenticated RCE.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}