Vulnerability in Electron-based Application: Unintentionally Giving Malicious Code Room to Run

This report details a remote code execution vulnerability in the Symbol Electron desktop wallet caused by nodeIntegration being enabled in the Electron BrowserWindow configuration; an attacker able to inject or load remote JavaScript (e.g., via the app's News feature) can invoke Node.js modules (child_process) to execute system commands. The authors provide a proof-of-concept, show Symbol patched the issue (nodeIntegration set to false and blocking remote content), and reported a similar configuration issue to MyCrypto.