[GH-ISSUE #856] Potential Command Execution vulnerabilities introduced by main-preload.js #414

New issue

Closed

opened 2026-03-03 00:20:58 +03:00 by kerem · 2 comments

kerem commented

2026-03-03 00:20:58 +03:00

Owner

Originally created by @xiaofen9 on GitHub (Mar 9, 2021).
Original GitHub issue: https://github.com/BoostIO/BoostNote-App/issues/856

Originally assigned to: @Rokt33r on GitHub.

Hi,

We found that static/main-preload.js introduces dangerous API openShellExternal for arbitrary access on unsafe renderer process.
This may lead to remote command execution.
We suggest that a URL check should be enforced at L15, which enforces an allowlist on trusted URLs.

github.com/BoostIO/BoostNote.next@a467dcb960/static/main-preload.js (L14-L17)

Originally created by @xiaofen9 on GitHub (Mar 9, 2021). Original GitHub issue: https://github.com/BoostIO/BoostNote-App/issues/856 Originally assigned to: @Rokt33r on GitHub. Hi, We found that `static/main-preload.js` introduces dangerous API openShellExternal for arbitrary access on unsafe renderer process. This may lead to remote command execution. We suggest that a URL check should be enforced at L15, which enforces an allowlist on trusted URLs. https://github.com/BoostIO/BoostNote.next/blob/a467dcb960531953040f26d09bd59a90c37a002e/static/main-preload.js#L14-L17

kerem

2026-03-03 00:20:58 +03:00

closed this issue
added the
assigned to core 🦹

security issue 🔑
labels

kerem commented

2026-03-03 00:20:59 +03:00

Author

Owner

@Rokt33r commented on GitHub (Aug 20, 2021):

Thanks for reporting. For now, it is okay since we're using the method with safe URLs only. So it won't cause any problems unless a user executing an arbitrary script from dev tools. But I'll make it safer for the case that someone makes a mistake.

@Komediruzecki This could be problematic for the local app since links in the markdown previewer are using this method without any URL filtering.

@Rokt33r commented on GitHub (Aug 20, 2021): Thanks for reporting. For now, it is okay since we're using the method with safe URLs only. So it won't cause any problems unless a user executing an arbitrary script from dev tools. But I'll make it safer for the case that someone makes a mistake. @Komediruzecki This could be problematic for the local app since links in the markdown previewer are using this method without any URL filtering.

kerem commented

2026-03-03 00:20:59 +03:00

Author

Owner

@xiaofen9 commented on GitHub (Jun 4, 2022):

Fixed by https://github.com/BoostIO/BoostNote.next-local/pull/39

@xiaofen9 commented on GitHub (Jun 4, 2022): Fixed by https://github.com/BoostIO/BoostNote.next-local/pull/39

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/BoostNote-App#414

No description provided.

Rows
Columns