MEDIUM

CVE-2026-90491

2026-09-13 CVSS v3.1

CVSS

6.3

Description

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness (CWE)

CWE-74 Injection

CWE-94 Code Injection

EPSS Score

0.24%

Probability of exploitation in next 30 days

15.7th percentile

References

https://github.com/LeoWSY-hashblue/cve-electron-2/blob/master/gsubs/cve.md https://github.com/LeoWSY-hashblue/cve-electron-2/tree/master/gsubs/poc https://vuldb.com/cve/CVE-2026-90491 https://vuldb.com/submit/891691 https://vuldb.com/vuln/403079 https://vuldb.com/vuln/403079/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE