critical9.8
CVE-2021-28119
Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution.
Impact
Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal API.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Twinkletray | Twinkle Tray | through 1.13.3 |