Breaking Into PostHog Prod Database
TLDR: PostHog used Playwright Chromium with --no-sandbox for heatmap screenshots. I used Claude to write a V8 n-day (CVE-2026-7899) exploit, got production RCE in a worker container with prod db access. I then used the same exploit as an evaluation for open-weight models.
With the increasing number of supply chain attacks, I was thinking of finding one as well. PostHog came to mind since we’re already using it at Hacktron. I started looking at their repositories to see if there was a misconfiguration that could let me take over their repo or packages. I didn’t find anything immediately, so out of curiosity I started looking at the product code itself.
Linha do tempo
-
Breaking Into PostHog Prod Database
ler a análise desta fonte ocultar
TLDR: PostHog used Playwright Chromium with --no-sandbox for heatmap screenshots. I used Claude to write a V8 n-day (CVE-2026-7899) exploit, got production RCE in a worker container with prod db access. I then used the same exploit as an evaluation for open-weight models.
With the increasing number of supply chain attacks, I was thinking of finding one as well. PostHog came to mind since we’re already using it at Hacktron. I started looking at their repositories to see if there was a misconfiguration that could let me take over their repo or packages. I didn’t find anything immediately, so out of curiosity I started looking at the product code itself.