Code Execution via Cross Site Scripting in Tagspaces (A file manager)

June 11, 2021 ◦ 1 min ◦

Security

#code execution
#cross site scripting
#TagSpaces
#Huntr
#bug bounty

Reported a code execution via cross site scripting in TagSpaces. The XSS is used to escape the sandbox of electron to gain code execution in TagSpaces.

References:

https://huntr.dev/bounties/1-other-tagspaces/tagspaces/
https://huntr.dev/bounties/1-other-tagspaces/viewerText/