CVE-2025-22136 Tabby has a TCC Bypass via Misconfigured Node Fuses

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors even though the...

MAL-2025-64 Malicious code in electron-wix-msi-local (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain...

Tabby 代码注入漏洞

Tabby Terminus is a highly configurable terminal emulator, SSH, and serial client for Windows 10, macOS, and Linux from the individual developers at Eugene. A code injection vulnerability exists in Tabby versions prior to 1.0.217, which stems from its enabling of multiple high-risk Electron Fuses...

Malicious code in electron-builder-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bba9892079dc9a4656f9576903aa20e7d320e80d687cffb7b05a31f1cff127b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

electron32 -- Type Confusion in V8

Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-12053...

Remote Code Execution (RCE)

Joplin is vulnerable to Remote code execution RCE. The vulnerability is due to insufficient sanitization of tag attributes introduced by the Mermaid feature, allowing execution of untrusted HTML content within the Electron window...

Malicious code in electron_npm_deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4fab50ae8be78e8043fb45e594ddc2011c78115201e0697bcdf80e50f785a40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

electron33 -- Inappropriate implementation in Extensions

Electron developers report: This update fixes the following vulnerability: Security: backported fix for CVE-2024-11110...

Malicious code in electron-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 225fd1032b65ae263dfc64ed2ad6cf7ddbc06d610ad48a513ad003e88accda6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10852 Malicious code in electron-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 225fd1032b65ae263dfc64ed2ad6cf7ddbc06d610ad48a513ad003e88accda6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OPENSUSE-SU-2024:14510-1 nodejs-electron-31.7.5-1.1 on GA media

These are all security issues fixed in the nodejs-electron-31.7.5-1.1 package on the GA media of openSUSE Tumbleweed...

nodejs-electron-31.7.4-1.1 on GA media (moderate)

nodejs-electron-31.7.4-1.1 on GA media Announcement ID: openSUSE-SU-2024:14494-1 Rating: moderate Cross-References: CVE-2024-10231 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

FreeBSD : electron31 -- multiple vulnerabilities (773e7eb2-af19-4fc7-be7f-0f6a2523b98b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 773e7eb2-af19-4fc7-be7f-0f6a2523b98b advisory. Electron developers report: This update fixes the following vulnerabilities: Tenable has...

CVE-2024-49362

Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This...

GHSA-HFF8-HJWV-J9Q7 Remote Code Execution on click of <a> Link in markdown preview

Summary There is a vulnerability in Joplin-desktop that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML...

Remote Code Execution on click of <a> Link in markdown preview

Summary There is a vulnerability in Joplin-desktop that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML...

CVE-2024-49362 Remote Code Execution on click of <a> Link in markdown preview

Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This...

CVE-2024-49362

CVE-2024-49362 (Joplin-desktop) describes a remote code execution (RCE) vulnerability caused by insufficient sanitization of tag attributes introduced by Mermaid. In the Markdown preview iframe, Joplin may open certain internal links when data-from-md is present, enabling execution of untrusted ...

CVE-2024-49362 Remote Code Execution on click of <a> Link in markdown preview

Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This...

CVE-2024-49362 Remote Code Execution on click of <a> Link in markdown preview

Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution RCE when a user clicks on an link within untrusted notes. The issue arises due to insufficient sanitization of tag attributes introduced by the Mermaid. This...