CVE-2025-29509

Jan v0.5.14 and before is vulnerable to remote code execution RCE when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal...

CVE-2025-29509

Jan versions v0.5.14 and before are vulnerable to Remote Code Execution (RCE) . The flaw exists because the application opens external websites and exposes the electronAPI without sufficient URL filtering when calling the shell.openExternal() function. An attacker could potentially execute arbitr...