Web Hack List

Preliminary research

FCSC 2026 "Aquarium": escaping the Node.js Permission Model

FCSC 2026: Aquarium

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Solves a Node.js challenge by importing a data URL whose fragment defeats an appended filename suffix. From a permission-limited process, readable process metadata and same-user signaling start an unrestricted peer’s inspector; debugger execution returns the result through the imported module rather than requiring an external output channel.

Record

Document
FCSC 2026: Aquarium
Researcher
_Worty
Published by
_Worty
Topic
Identity

In the archive

Tags

This page is the archive's own catalogue record. The research is the work of _Worty, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .