Popular web app framework allows remote code execution

A serious vulnerability in the Electron framework, which underpins many web apps such as Slack, Skype and Signal, could be exploited to allow attackers to run malicious code on victim computers.

The vulnerability affects Electron.js apps running on Windows. Apps on Apple's macOS operating system or Linux distributions are not impacted.

Electron has patched the remote code execution vulnerability in the latest versions of the framework, and is urging developers to update their applications.

Attackers can take advantage of the flaw by abusing Electron apps that register themselves as the default handler for a protocol, such as slack://.

This means users who click on specially crafted links could inadvertently run malicious code that can be used for information leakage as well as to deploy ransomware.

Microsoft's Skype communications app and the Visual Studio Code editor are also affected by the vulnerability.

Slack version 3.0.3 and the latest version of Skype for Windows have been patched against the flaw.