TradingView Desktop CVE-2025-14498
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local code execution
-
ExploitPlant malicious script in unsecured search path
-
ExecutionTradingView Electron loads attacker script
-
ImpactExecute arbitrary code as target user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires the attacker to first obtain the ability to run low-privileged code on the target system (AV:L, PR:L), then write a script or library into the unsecured, attacker-writable location that TradingView Desktop's Electron framework searches when loading its script file (CWE-427, uncontrolled search path). Limiting factors: the attacker needs pre-existing local access with write permission to that search location, and a running/launched instance of TradingView Desktop to trigger the load; there is no remote vector and no network exposure. No user interaction is required (UI:N) once local footing exists. |
| Impact | This is a legitimate local privilege-escalation issue rather than an inflated high-CVSS score, but it is not an emergency. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) is internally consistent with the description: AV:L and PR:L correctly reflect that the attacker must already hold low-privileged code execution on the host, while C:H/I:H/A:H reflect full code execution in the target user's context via an uncontrolled search path (CWE-427). No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The requirement for pre-existing local access (AV:L/PR:L) substantially limits real-world risk - this is a post-compromise escalation primitive, not a remotely reachable flaw. One signal to note: the Tags include 'RCE', which could be read as remote code execution, but both the CVSS vector (AV:L) and the ZDI description confirm the execution is strictly local, so 'RCE' here means arbitrary code execution, not remote - do not treat this as network-exploitable. |
| Exploit ScenarioDerived | An attacker who has already achieved low-privileged code execution on a workstation (e.g., via a phishing payload or an existing low-priv account) plants a malicious script or library in the unsecured location that TradingView Desktop's Electron configuration searches. When the application loads that script, the attacker's code runs in the context of the targeted user, escalating their effective privileges. No public exploit was provided in the input, and exploitation requires no user interaction (UI:N) once the attacker has local footing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in TradingView Desktop's Electron framework lets an attacker who already holds low-privileged code execution write a malicious script into an unsecured, attacker-writable search location that the application loads, resulting in arbitrary code execution in the context of the targeted user. The flaw (CWE-427, uncontrolled search path) is rated CVSS 7.8 on a local vector (AV:L/AC:L/PR:L/UI:N), so it is not remotely reachable and requires existing local footing plus write access to the relevant path. No public exploit code or CISA KEV entry was identified at time of analysis, and the ZDI advisory ZDI-25-1070 is the primary reference.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis, so remediation should begin with monitoring the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-1070/) and TradingView's release channels for a fixed build and applying it as soon as it is published. In the interim, restrict write access through NTFS ACLs or POSIX permissions to the TradingView Desktop installation directory and any directories in the Electron script or module search path so standard users cannot plant files there; this is the most direct compensating control, though tightening ACLs can interfere with auto-updaters or user-installed extensions and should be tested first. Run TradingView Desktop under a least-privileged account and avoid granting local administrator rights, while recognizing that the PR:L rating means this alone does not eliminate the flaw. Application allowlisting and EDR rules that alert on new script or module files appearing in the application directory or search-path locations provide detection coverage for attempted exploitation, with the trade-off of potential false positives from legitimate updates. Because exploitation requires pre-existing local code execution, reducing initial local attack surface and monitoring for suspicious low-privileged processes remain important supporting measures.
Affected ProductsAI
TradingView Desktop installations built on the Electron framework are affected according to the ZDI advisory ZDI-25-1070 (https://www.zerodayinitiative.com/advisories/ZDI-25-1070/). The provided intelligence does not include an exact affected version range, CPE strings, or a platform breakdown, so version-specific scoping should be confirmed against the vendor's release notes and the ZDI advisory. The flaw concerns the application's script-loading and search-path configuration rather than a discrete library dependency, meaning any build that resolves and loads a script from the unsecured location may be exposed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is rooted in CWE-427 (Uncontrolled Search Path Element) within the Electron framework configuration used by TradingView Desktop. Electron-based applications can load JavaScript, native modules, or helper binaries from locations resolved through a search path; when one of those locations is writable by a low-privileged user, an attacker can plant a file with the expected name and have it executed by the application. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local attack requiring low privileges and no user interaction, with high confidentiality, integrity, and availability impact and unchanged scope. Exploitation depends on the attacker first obtaining code execution at low privilege, for example through a separate client-side or local flaw, and then abusing file-write permissions on the affected search location while a TradingView Desktop instance launches or loads the script. No CPE data or specific version range was provided in the available intelligence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker needs pre-existing low-privileged local execution (AV:L, PR:L), the search-path load is reliable with no interaction (AC:L, UI:N), and code runs as the user with full C/I/A impact.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
TradingView Desktop Electron Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TradingView Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the configuration of the Electron framework. The product loads a script file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27395.
Executive ViewAI
TradingView Desktop endpoints are exposed to a high-severity local privilege-escalation flaw that could allow an attacker with an existing low-privileged foothold to execute code as the logged-in user. No public exploit identified at time of analysis, and the issue is not remotely reachable, so immediate enterprise-wide risk is concentrated on compromised or poorly hardened workstations. Leadership should care because unpatched desktop software can deepen an attacker’s control after initial compromise, and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict write access to TradingView Desktop installation and Electron search-path directories, enforce least privilege and remove local admin rights, apply application allowlisting and EDR monitoring for script creation, and review endpoints for signs of prior local compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB