EUVD-2026-76933
GHSA-qcwq-wqp5-v342
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth required; user interaction needed to trigger showQuerySuccessPage; impact limited to low C/I/A per CVSS 4.0 input metrics; no scope change confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Code injection in sanjevirau gsubs (Electron application) up to version 1.0.3 allows remote attackers to execute arbitrary code by manipulating the filename argument passed to the showQuerySuccessPage function in renderer/index.js. The vulnerability exists in the Electron renderer process and requires passive user interaction to trigger. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target user to passively interact with content that triggers the showQuerySuccessPage function with an attacker-controlled filename argument - the CVSS UI:P metric confirms this passive user interaction requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L reflects a moderate severity assessment: network-reachable, no authentication required, but user interaction needed (UI:P) and impact limited to the vulnerable system at low levels (C/I/A all L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the vendor was contacted but did not respond. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today