-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| electron-markdownify | npm | <= 1.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems directly from enabling nodeIntegration in Electron's BrowserWindow configuration. This setting allows the renderer process to access Node.js APIs, which when combined with untrusted content rendering (markdown files), enables RCE through constructs like require('child_process').exec(). The main.js file is Electron's main process entry point where window configuration typically occurs. While no specific function names are provided in available sources, the BrowserWindow instantiation with insecure settings is the root cause.
Ongoing coverage of React2Shell