LOW2.5

GHSA-xgq9-7gw6-jr5r

Mattermost Desktop App fails to sufficiently configure Electron Fuses

Quick fix

GHSA-xgq9-7gw6-jr5r — mattermost-desktop: upgrade to the fixed version with the command below.

npm install mattermost-desktop@5.9.0

Details

Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/mattermost-desktop

Introduced in: 0Fixed in: 5.9.0

Fixnpm install mattermost-desktop@5.9.0

References

https://nvd.nist.gov/vuln/detail/CVE-2024-45835[ADVISORY]
https://github.com/mattermost/desktop[PACKAGE]
https://mattermost.com/security-updates[WEB]