9.4 High
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
81.2%
static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.
github.com/BoostIO/BoostNote-App/issues/856