54 matches found
CVE-2025-29509
Jan versions v0.5.14 and before are vulnerable to Remote Code Execution (RCE) . The flaw exists because the application opens external websites and exposes the electronAPI without sufficient URL filtering when calling the shell.openExternal() function. An attacker could potentially execute arbitr...
CVE-2025-29509
Jan v0.5.14 and before is vulnerable to remote code execution RCE when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal...
CVE-2025-29509: Improper Neutralization of Special Elements used in a Command
Jan v0.5.14 and before is vulnerable to remote code execution RCE when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2024-48463
Bruno IDE Desktop versions prior to 1.29.1 are vulnerable to a command injection vulnerability (CWE-78) and unvalidated URL handling. The root cause is the use of Electron's shell.openExternal function within the Markdown docs viewer without proper validation of http or https protocols. This allo...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2024-48463: URL Redirection to Untrusted Site
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2023-42222
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...
CVE-2023-42222: Undefined Security Weakness
WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...
CVE-2023-42222
WebCatalog (desktop app) before version 49.0 is vulnerable to Incorrect Access Control due to Electron shell.openExternal being invoked without validating http/https URLs. The CVE-2023-42222 description and Red Hat/PRION entries confirm this issue affects WebCatalog pre-49.0 with potential for co...
CVE-2022-44567: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in Rocket.Chat-Desktop 3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video...
Rocket.Chat: Insecure use of shell.openExternal() leads to RCE in Rocket.Chat-Desktop
Rocket.Chat-Desktop passes the parameter url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used...
GHSA-MJR5-V9C9-MM7G Joplin Remote Code Execution
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before...
CVE-2022-40277
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before...
CVE-2022-40277
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before...
CVE-2022-40277: Improper Input Validation
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before...
Zulip Desktop Remote Code Execution Vulnerability
Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Desktop is the Zulip desktop client. A remote code execution vulnerability exists in Zulip Desktop versions prior to 5.0.0. The...