A critical vulnerability in Google’s shared DevSite platform allowed unauthenticated attackers to forge Flask session cookies and trigger remote code execution through unsafe Python deserialization.