Other nomination

From Markdown to RCE in Atom

The Atom editor's Markdown preview rendered arbitrary HTML behind a weak attribute-stripping sanitiser, so an iframe could load a bundled local HTML file that passed the URL query string to eval. Because Electron runs that file under the same file:// origin, the chain reaches window.top.require('child_process') and executes local code from a package README.

Record

Published by

statuscode.ch

In the archive

• Nominated for the 2016–17 Top 10 Web Hacking Techniques

Tags

• xss
• rce
• electron
• sanitizer-bypass
• csp
• iframe
• attack-chain
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of statuscode.ch, first published at the original source. Preserved copies are kept so the citation survives its host.