Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Boost Note 注入漏洞
Vulnerability Description
Boost Note是开源的一个开发人员友好的工作区，具有类似 IDE 的 UX。它提供了以下侧重于信息管理和可搜索性的功能。 Boost Note 0.22.0之前版本存在安全漏洞，该漏洞源于软件中static/main-preload.js缺乏有效的过滤与验证，允许远程执行命令。远程攻击者可利用该漏洞可能会向暴露的易受攻击的ipcRenderer IPC接口发送精心设计的IPC消息，从而调用危险的openExternal Electron API。
CVSS Information
N/A
Vulnerability Type
N/A