Submit #1013190: Nerimity nerimity-desktop 2.2.0 / commit fb9c56c97 Code Injection

Nerimity nerimity-desktop v2.2.0 allows remote code execution via unrestricted shell.openExternal in the Electron main process (CWE-939: Improper Authorization in Handler for Custom URL Scheme).

Nerimity Desktop is an Electron desktop client for the Nerimity chat platform. The application loads remote web content and registers a window-open handler that blindly passes attacker-controlled URLs to Electron's shell.openExternal() API.

Vulnerable code, src/mainWindow.js:185-188:

mainWindow.webContents.setWindowOpenHandler((details) => {
shell.openExternal(details.url);
return { action: "deny" };
});

There is no allowlist restricting details.url to safe web schemes such as https: and http:. If remote renderer content, a chat message interaction, or a renderer injection primitive causes window.open() to be called with a dangerous URL such as a file://example.com///path/to/malicious.bat') -> src/mainWindow.js:185 setWindowOpenHandler receives details.url -> src/mainWindow.js:186 shell.openExternal(details.url) -> no scheme validation or allowlist -> Windows executes the .bat file -> arbitrary OS command execution in the user's context. The primitive is especially risky because the desktop shell is a privileged wrapper around remote chat/web content.

Proof of Concept: verified on Windows 11 with Electron 41.0.4 using the unmodified vulnerable handler logic from src/mainWindow.js:185-188. The PoC harness creates a hidden BrowserWindow, registers the same handler, loads poc_page.html, and triggers window.open on a generated batch file. The batch file writes a marker containing the current Windows user and host name, then launches Calculator. Observed output: [+] L5_CONFIRMED marker: RCE_B02_NERIMITY WSY LAPTOP-DK6EM0VH 2026/07/14 10:45:33.13. Marker file poc/evidence.txt MD5: bd8210a3af62f0526b9e6acdfbcc7f5e. Full PoC harness and evidence: https://github.com/LeoWSY-hashblue/cve-electron-2/tree/master/nerimity-desktop/poc

CVSS 3.1: 8.8 High (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). CWE-939.

Impact: arbitrary command execution as the desktop user - read and modify user files, launch local programs, install persistence, pivot to other local resources.

Fix: only forward explicitly allowed web schemes to shell.openExternal(); deny all other schemes. Deny file:, javascript:, data:, ms-*: and other non-web schemes. Treat all remote renderer content as untrusted and avoid bridging remote content directly to privileged Electron APIs.

Version: 2.2.0 / commit fb9c56c97. Repository: https://github.com/Nerimity/nerimity-desktop

• Source: ⚠️ https://github.com/LeoWSY-hashblue/cve-electron-2/blob/master/nerimity-desktop/cve.md
• User: NeoWSY (UID 82976)
• Submission: 10/04/2026 16:55 (27 days ago)
• Moderation: 10/20/2026 08:23 (16 days later)
• Status: Accepted
• VulDB entry: 422677 [Nerimity Desktop up to 2.2.2 Window Open src/mainWindow.js shell.openExternal url improper authorization in handler for custom url scheme]
• Points: 20