# elr (blogs) — RSS Amplifier Recent posts from the 1 feeds in the RSS Amplifier directory that cover elr. Page: Feed: --- ## [From a Schema Name to RCE in n8n](https://simonkoeck.com/writeups/n8n-gsuiteadmin-prototype-pollution-rce/) _2026-08-16 · Simon Koeck_ n8n uses a user-supplied schema name as a bare object key. Set it to \_\_proto\_\_, pollute the prototype, chain into RCE via the Git node. One request, full shell. ## [How to Test Your PGP Email Setup End to End](https://simonkoeck.com/blog/testing-pgp-email-setup/) _2026-05-15 · Simon Koeck_ Setting up PGP email is easy now. Confirming that the encryption, key discovery, and signing actually work end to end, less so. Here is how to test your PGP email setup, what can go wrong, and a free tool that does the round trip for you. ## [ELRS Security: What's Actually Possible Over the Air](https://simonkoeck.com/blog/elrs-security-what-is-possible/) _2026-05-11 · Simon Koeck_ I bought a Radiomaster running ExpressLRS and wanted to understand what an attacker could realistically do to a drone in flight. The answer is more interesting than the 2022 headlines suggested, and also more boring. ## [One Uppercase Letter Breaks Every Nuxt App](https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling/) _2026-04-08 · Simon Koeck_ h3 powers every Nuxt app but only recognized 'chunked' in lowercase. Send 'ChunKed' instead and you get request smuggling. ## [Reading /etc/passwd via Translation Upload in Tolgee](https://simonkoeck.com/writeups/tolgee-xxe-translation-import/) _2026-04-07 · Simon Koeck_ Tolgee's XML translation importers ship with zero security config. Upload a crafted file, read anything from the server. Confirmed on their cloud platform.