BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: WASM Was Not the Boundary: Sandcastles\, Not Sandbox
 es\n   Tags: DEF CON Official Talk | Demo 💻 | Exploit 🪲\n   When: Fr
 iday\, Aug 7\, 14:30 - 15:30 PDT\n   Where: LVCCW Level 1 Hall 3 1007 (Mai
 n Track 2) and DCTV-2 - [1]Map\n\n   Description:\n   Pyodide is often tre
 ated as a ready-made sandbox: block os\, block js\,\n   and untrusted Pyth
 on is assumed to stay inside WebAssembly. In n8n and\n   the other product
 s we tested\, that assumption failed. When ctypes or\n   reflection\n   re
 mained reachable\, attacker-controlled Python could cross from\n   CPython
 -in-WASM into the Emscripten/JavaScript host boundary the\n   product\n   
 actually relied on.\n\n   We show this as an architectural failure\, not a
  one-off bug. In\n   Node.js embeddings\, that boundary break typically be
 comes immediate\n   host-side code execution because the escaped code land
 s in a runtime\n   with no native permission model. In Deno embeddings\, t
 he same break\n   still reaches the embedding runtime\, but the final blas
 t radius\n   depends on the permissions the product granted\; in one defau
 lt\n   configuration\, that still meant full RCE. In CI environments\, the
  same\n   mistake turns tests and build steps into a supply-chain risk bec
 ause\n   the escaped code runs next to tokens\, secrets\, and release arti
 facts.\n\n   Across workflow automation\, spreadsheets\, AI agents\, deskt
 op wrappers\,\n   and build tooling\, we found seven escapes\, two public 
 CVEs\, and\n   multiple additional disclosures. Attendees leave with a pre
 cise mental\n   model of where Pyodide isolation actually ends\, how to te
 st similar\n   deployments\, and how to harden them beyond fragile denylis
 ts.\n\n     * \n\n       Pyodide documentation. Pyodide is CPython compile
 d with Emscripten\n       to WebAssembly and embedded in a JavaScript host
 \; this\n       host-embedding model is central to our analysis.\n       h
 ttps://pyodide.org/\n\n         * \n\n           Emscripten API documentat
 ion for emscripten_run_script*. These\n           APIs are the JavaScript-
 execution bridge we reached from\n           Pyodide via ctypes. https://e
 mscripten.org/\n\n         * \n\n           Lehmann et al.\, "Everything O
 ld is New Again: Binary Security\n           of WebAssembly\," USENIX Secu
 rity 2020.\n\n         * \n\n           Bosamiya et al.\, "Provably-Safe M
 ultilingual Software\n           Sandboxing using WebAssembly\," USENIX Se
 curity 2022.\n\n         * \n\n           Zhao et al.\, "Remote Code Execu
 tion from SSTI in the Sandbox:\n           Cracking the Sandbox of Templat
 e Engines via Isolation-Aware\n           Attack\," USENIX Security 2023.\
 n\n         * \n\n           Public advisories for two instances from this
  research:\n           CVE-2025-68668 / GHSA-62r4-hw23-cc8v (n8n) CVE-2026
 -24002 /\n           GHSA-7xvx-8pf2-pv5g (Grist)\n\n   Speakers:Saar Pearl
 \,Vladimir "G1ND1L4" Tokarev\n\n   SpeakerBio:  Saar Pearl\, Cyera\n\n   S
 aar Pearl is a security researcher at Cyera. He specializes in\n   offensi
 ve security and vulnerability research across cloud\n   infrastructure and
  SaaS platforms\, focusing on identity and access\n   controls\, architect
 ural weaknesses and exploit development.\n\n   SpeakerBio:  Vladimir "G1ND
 1L4" Tokarev\, Cyera\n\n   Vladimir Tokarev is a vulnerability researcher 
 tech lead at Cyera\,\n   specializing in Cloud\, IoT/OT\, Windows\, Linux\
 , and AI vulnerability\n   research and exploit. Talks: Black Hat USA 2024
  and 2023\,\n   DEF CON 33 Recon Village 2025\, CodeBlue 2025\, RSA 2024.\
 n\n   '\n\n   1. #LVCCW_Level1_Hall3\n\n\n
DTEND:20260807T223000Z
DTSTART:20260807T213000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1007 (Main Track 2) and DCTV-
 2
SUMMARY:WASM Was Not the Boundary: Sandcastles\, Not Sandboxes
END:VEVENT
END:VCALENDAR