← Database

CVE-2021-41392

CRITICAL CVSS: 9.8 Published: 2021-09-17 Modified: 2026-06-17

Description

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.

Affected Platforms

Boostnote Boostnote

Weakness Type

CWE-74

References