https://assakaf.com/ Original vulnerability research: advisories, CVEs and open-source security write-ups. en https://assakaf.com/articles/n8n-prototype-pollution-auth-bypass/ https://assakaf.com/articles/n8n-prototype-pollution-auth-bypass/ A two-level dynamic write in replaceInvalidCredentials pollutes Object.prototype from a default Member account, so req.user resolves for unauthenticated requests and every account email, role and MFA status leaks. Tue, 07 Jul 2026 00:00:00 GMT https://assakaf.com/articles/paperless-ngx-privesc/ https://assakaf.com/articles/paperless-ngx-privesc/ A type-coercion slip in UserViewSet let any account holding auth.add_user create a full superuser. Published as GHSA-59xh-5vwx-4c4q, CVSS 7.1. Mon, 16 Mar 2026 00:00:00 GMT https://assakaf.com/articles/httpx-graceful-shutdown/ https://assakaf.com/articles/httpx-graceful-shutdown/ On interrupt, httpx saved a resume index based on dispatched targets, not completed ones, silently skipping 51 of 108 hosts on resume. PR #2393 makes shutdown drain in-flight work first. https://assakaf.com/articles/steampipe-googleworkspace-reports/ https://assakaf.com/articles/steampipe-googleworkspace-reports/ Added an Admin Reports table to the Steampipe Google Workspace plugin: query Workspace audit logs (logins, admin actions, OAuth tokens, Drive, mobile) as SQL for detection and compliance. PR #88, merged.