EUVD-2026-30773
GHSA-53vh-ccq9-xwq5
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionNVD
Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrary operating system commands.
AnalysisAI
Remote code execution in Offline Hospital Management System 5.3.0 stems from an insecure Electron renderer configuration where Node.js integration is enabled while context isolation is disabled, allowing JavaScript in the renderer to invoke Node.js APIs and run arbitrary OS commands. The flaw carries a CVSS 7.3 with network attack vector and no privileges required, though EPSS is low at 0.06% and no public exploit identified at time of analysis beyond a Medium write-up describing the technique.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 HOURS: Conduct inventory of systems running OHMS 5.3.0; restrict network access and isolate non-critical deployments; apply all available Electron framework security patches. 7 DAYS: Implement network segmentation limiting system accessibility; disable Node.js integration in Electron renderer configuration where operationally feasible; enable context isolation. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today