Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
概要
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web vikunja.io