MEDIUM5.3

GHSA-wj4j-qc2m-fgh7

Mattermost Desktop App Uncontrolled Search Path Vulnerability

Quick fix

GHSA-wj4j-qc2m-fgh7 — mattermost-desktop: upgrade to the fixed version with the command below.

npm install mattermost-desktop@5.9.0

Details

Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/mattermost-desktop

Introduced in: 0Fixed in: 5.9.0

Fixnpm install mattermost-desktop@5.9.0

References

https://nvd.nist.gov/vuln/detail/CVE-2024-39613[ADVISORY]
https://docs.mattermost.com/about/desktop-app-changelog.html[WEB]
https://github.com/mattermost/desktop[PACKAGE]
https://mattermost.com/security-updates[WEB]