Description

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T02:17:03.097Z",
  "pubdate": "2026-09-13T02:17:03.097Z",
  "executiveSummary": "A critical code injection vulnerability exists within the sanjevirau gsubs application, specifically within the Electron-based renderer process. The vulnerability arises due to improper handling of user-supplied input via the filename argument in the showQuerySuccessPage function.\nThis flaw allows remote attackers to inject and execute arbitrary code by manipulating the filename parameter, bypassing intended application logic. The vulnerability affects all versions of gsubs up to 1.0.3.\nGiven that public exploit code is available and the vendor has remained unresponsive to disclosure, this represents a significant security risk for users. Successful exploitation enables remote attackers to achieve unauthorized code execution within the context of the renderer process, potentially leading to a complete compromise of the local application environment or lateral movement within the host system depending on the Electron configuration.",
  "technicalDetails": "The vulnerability resides in the renderer/index.js file within the gsubs component, specifically inside the showQuerySuccessPage function. The root cause is a failure to properly sanitize or validate the filename argument before it is processed by the application's internal rendering logic.\nIn the context of an Electron application, the renderer process typically handles the UI and user interactions. When the showQuerySuccessPage function receives a crafted filename argument, it fails to perform adequate input validation. If the application passes this unsanitized input to functions that interpret or execute strings as code (such as certain DOM manipulation APIs, context-bridging mechanisms, or Node.js integration points), it triggers an arbitrary code injection.\nThe attack flow begins when a remote attacker delivers a malicious payload via the filename argument. Because the application processes this argument without sufficient sanitization, the attacker can break out of the intended string context. By injecting JavaScript or leveraging Electron-specific vulnerabilities, the attacker forces the renderer process to execute unauthorized instructions.\nSince this is an Electron-based application, successful exploitation of the renderer process can have severe implications. If Node.js integration is enabled in the renderer (a common configuration error), the attacker can transition from renderer-level code execution to full system-level command execution, gaining access to the filesystem, environment variables, and external network resources.\nThe attack is remotely exploitable, meaning an attacker does not require local access or previous authentication to trigger the flaw. The lack of input sanitization acts as a primary vector for cross-site scripting (XSS) or deeper Remote Code Execution (RCE) depending on how the application handles the file reference after the injection.\nThis vulnerability is particularly dangerous because the exploit mechanism is publicly available, allowing threat actors to weaponize the flaw against existing installations of gsubs versions 1.0.3 and below. The absence of vendor intervention means that users are currently exposed without an official security update to remediate the underlying logic error."
}