arbitrary-file-open

1 article
sort: new top best
clear filter
0 8/10
vulnerability

GitHub Desktop on macOS allowed remote code execution via a crafted x-github-client:// URI with a malicious filepath parameter that bypassed repository directory restrictions and enabled execution of arbitrary application bundles. The vulnerability exploited Electron's shell.openExternal() function converting file paths to file:// URLs, allowing attackers to execute malicious OSX apps cloned from attacker-controlled repositories.

GitHub Desktop 0xacb HackerOne H1-702 GitHub Electron CVE (unreferenced but likely assigned) zhuowei
pwning.re · devanshbatham/Awesome-Bugbounty-Writeups · 20 hours ago · details