Finding a $90,000 Remote Code Execution Vulnerability in Google
A researcher earned $90,000 for a fixed unauthenticated RCE in Google's shared developer-docs platform via Flask session pickle.
61
Product
DevSite
- Mentions · 7d0
- Mentions · 30d2
- All mentions2
- First seenOct 12, 2026
- Last mentioned19d ago
Timeline
2 articles · newest firstGoogle DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions
A patched Google DevSite flaw let unauthenticated attackers forge Flask sessions and achieve remote code execution.
72
Appears with
- Googleorganization · 2
- Flaskproduct · 2
- Googlevendor · 2
- oauth2clientproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.