Geoffrey Diederichs

Geoffrey Diederichs is a member of the Offensive Security team at Escape, an ethical hacker specializing in web application and API security. His work sits at the intersection of hands-on OffSec, vulnerability research, and AI.

Geoffrey Diederichs

Geoffrey Diederichs — Last Publications

Escape research found an auth bypass in Ghost that can wipe all member's votes. It's now CVE-2026-103288.
Research

Escape research found an auth bypass in Ghost that can wipe all member's votes. It's now CVE-2026-103288.

Escape's research team found two stacked flaws that led to an auth bypass enabling any member to delete all members' likes on comments. It's now CVE-2026-103288, found only by testing as multiple low-auth users to see what they could do with data they shouldn't have access to.
Geoffrey Diederichs
Geoffrey Diederichs
10 min read
Escape found the same XSS in two AI chatboxes. The vulnerability was in the Markdown renderer.
Offensive Security

Escape found the same XSS in two AI chatboxes. The vulnerability was in the Markdown renderer.

Weeks apart, at two unrelated companies, Escape's AI pentesting agent found the same stored XSS. Both had shipped a customer-facing chat where the model emits Markdown and the frontend renders it with raw HTML enabled and no sanitizer, so anything the model can be made to say executes
Gwendal Mognier
Geoffrey Diederichs
Gwendal Mognier, Geoffrey Diederichs
8 min read

Escape Blog Squad