Unscored CVE-2021-28119 EUVD-2021-14820GHSA-45r4-mhgp-24v6

Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exp…

Published Mar 9, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Description

Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal API.

References

https://github.com/xanderfrangos/twinkle-tray/issues/142