Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
Résumé
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables nodeIntegration in the renderer process without contextIsolation or sandbox. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web vikunja.io