Skip to content
OpenAdvisories
Unscored CVE-2021-41392 EUVD-2021-28420GHSA-8h86-6q3w-5h6p

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to th…

Published Sep 17, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.

References