jscythe

jscythe abuses the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code, even if their debugging capabilities are disabled. Tested and working against Visual Studio Code, Discord, any Node.js application and more! How 1. Locate t...

kraken

Warning I have been reviewing the Kraken-Client code and since this was my first ever react app, its old, clunky and it needs major improvement the server needs some work too. In the next few weeks/months I will do my best to rewrite it in either updated React or in another framework. Please feel...

CVE-2026-90491

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

EUVD-2026-76933

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

CVE-2026-90491 sanjevirau gsubs Electron index.js showQuerySuccessPage code injection

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

CVE-2026-90491

sanjevirau gsubs (up to version 1.0.3) contains a code injection vulnerability in the showQuerySuccessPage function of renderer/index.js within its Electron component. The root cause is an improper handling of the filename argument, which can be manipulated by a remote attacker to inject and exec...

electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

memoro

Memoro Memoro is a highly detailed heap profiler. Memoro not only shows you where and when your program makes heap allocations, but will show you how your program actually used that memory. Memoro collects detailed information on accesses to the heap, including reads and writes to memory and when...

PT-2026-90732

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

XSSTRON

XSSTRON, Electron JS Browser To Find XSS Vulnerabilities Powerful Chromium Browser to find XSS Vulnerabilites automatically while browsing web, it can detect many case scenarios with support for POST requests too Installation root@kitploit: Install Node.js and npm https://www.npmjs.com/get-npm or...

redjoust

ᵔᴥᵔ RedJoust A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron. Join the community Join the community of Kawaiipantsu / THUGSred and participate in the dev talk around Redjoust or simpl...

ff-password-exporter

FF Password Exporter It can be difficult to export your passwords from Firefox. Since version 57 of Firefox Quantum existing password export addons no longer work. Mozilla provides no other official alternatives. FF Password Exporter makes it quick and easy to export all of your passwords from...

Empire-GUI

Empire GUI The Empire Multiuser GUI is a graphical interface to the Empire post-exploitation Framework. It was written in Electron and utilizes websockets SocketIO on the backend to support multiuser interaction. The main goal of this project is to enable red teams, or any other color team, to wo...

CVE-2024-23746

CVE-2024-23746 macOS 上の Miro Desktop 0.8.18 は Electron コードインジェクションを許可します。 PoC 署名とバージョン: 脆弱性の調査に使用したツール: https://github.com/r3ggi/electroniz3r 脆弱性があるか確認: Blind Shell を注入: 参照 https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib...

Loki

🧙‍♂️ Loki 명령 및 제어 Loki는 취약한 Electron 앱을 스크립트 잭script-jack하도록 설계된 Node.js 기반 1단계 C2명령 및 제어 프레임워크입니다 MITRE ATT&CK T1218.015. 레드 팀 운영을 위해 개발된 Loki는 신뢰할 수 있는 서명된 Electron 앱을 악용하여 보안 소프트웨어를 우회하고 애플리케이션 제어를 우회할 수 있게 해줍니다. 스크립트 잭킹은 런타임에 로드되는 JavaScript 파일을 임의의 Node.js 코드로 수정하여 Electron 앱의 실행 흐름을 가로챕니다. 이...

Hermes-Proxy

Hermes Proxy Hermes Proxy — это десктопное приложение для перехвата HTTP/HTTPS трафика, созданное с помощью Electron и Vite. Оно перехватывает запросы/ответы, позволяет повторно отправлять запросы, а также экспортировать и импортировать HAR-файлы. Возможности Таблица трафика в реальном времени с...

CVE-2024-23739

CVE-2024-23739 Проблема в Discord до версии 0.0.291 на macOS позволяет удаленному злоумышленнику выполнить произвольный код через настройки RunAsNode и enableNodeClilnspectArguments. Существует инструмент, предназначенный для автоматизации процесса поиска уязвимостей в electron:...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

CVE-2026-Discord

Critical Vulnerability Report: Discord macOS Client 날짜 : 2026-01-25 대상 : Discord 클라이언트 macOS Stable 0.0.373 작성자 : Antigravity 🚨 핵심 요약 우리는 Discord macOS 클라이언트Electron 기반에서 로컬 구성 또는 명령줄 플래그를 통한 원격 디버깅 포트9222의 강제 노출 과 관련된 심각한 보안 취약점을 식별했습니다. 이로 인해 로컬 공격자는 인증2FA, 비밀번호을 완전히 우회 하고 클라이언트 내에서 원격 코드 실행RCE...

CVE-2024-25292

RenderTune RCE CVE-2024-25292 취약점에 대한 개념 증명PoC입니다. RenderTune v1.1.4의 XSS교차 사이트 스크립팅 취약점으로 인해 공격자가 Upload Title 매개변수에 조작된 페이로드를 주입하여 임의의 웹 스크립트나 HTML을 실행할 수 있습니다. 이 저장소에는 취약한 애플리케이션 예제와 이에 대한 개념 증명PoC 익스플로잇이 포함되어 있습니다. PoC로는 프로세스를 자동화하는 Python 파일이 있습니다. 1. 취약점 개요: XSS를 통해 RCE를 가능하게 하는 취약점입니다. 제목에...