CVE-2026-85107

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107

A vulnerability in NousResearch hermes-agent 0.18.0 affects the resourceBufferFromUrl function in apps/desktop/electron/main.ts (Electron Main Process), allowing a remote attacker with user interaction to trigger uncontrolled resource allocation, resulting in low availability impact. Notably, the...

EUVD-2026-70454

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

CVE-2026-85107 NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated...

@xwiki/cristal-electron-main (>=1.3.0, <=1.5.0), cicy-desktop (>=2.1.30, <=2.1.325) +2 more potentially affected by CVE-2026-70603 via electron (>=41.0.3, <=41.1.0)

electron NPM version =41.0.3, =1.3.0, =2.1.30, =0.1.0, =1.0.5, =1.3.0 Source cves: CVE-2026-70603 Source advisory: SNYK:JS-ELECTRON-18563328...

CVE-2026-44482 soundcloud-rpc: Remote Code Execution via XSS in Track Title

soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on...

CVE-2026-42045

CVE-2026-42045 affects LobeHub/LobeChat prior to version 2.1.48. The issue combines a client‑side XSS in the Render path (Renderer defaulting to HTMLRenderer for unknown tags) with an insecure IPC interface runCommand in the Electron main process. An attacker who can induce the LLM to emit malici...

CVE-2026-42045 LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, when LobeChat processes custom tags in the Render process of src/features/Portal/Artifacts/Body/Renderer/index.tsx, if no type match is found, it will choose to call the...

GHSA-XQ4X-622M-Q8FQ LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution

Summary The vulnerability was automatically discovered by an ai agent and then manually verified. LobeChat's message rendering mechanism has a stored cross-site scripting XSS vulnerability. Combined with the Electron main process's exposed insecure IPC interface, attackers can construct malicious...

@finsemble/finsemble-core (>=8.15.0-beta.1, <=9.8.1-test.1), @finsemble/finsemble-electron-adapter (>=8.15.0-beta.1, <=9.8.1-test.1) +4 more potentially affected by CVE-2025-55305 via electron (>=35.0.0, <=35.5.1)

electron NPM version =35.0.0, =8.15.0-beta.1, =8.15.0-beta.1, =1.1.0, =0.16.0, =1.0.10, =1.0.16 Source cves: CVE-2025-55305 Source advisory: SNYK:JS-ELECTRON-12485155...

PT-2024-20224 · Unknown · Lukas Bach

Name of the Vulnerable Software and Affected Versions: Lukas Bach yana version 1.0.16 Description: The issue is related to Cross Site Scripting XSS via src/electron-main.ts. Recommendations: For version 1.0.16, update to a version that is 1.0.16 or later to resolve the issue. As a temporary...

Yana Security Breach

Yana is a powerful laptop application from the individual developer Lukas Bach. A security vulnerability exists in Yana version 1.0.16 and prior versions, which stems from a cross-site scripting vulnerability in the src/electron-main.ts location...