CVE-2026-90491 Overview
CVE-2026-90491 is a code injection vulnerability [CWE-74] affecting sanjevirau gsubs versions up to 1.0.3. The flaw resides in the showQuerySuccessPage function within renderer/index.js, part of the application's Electron component. Attackers can manipulate the filename argument to inject and execute code within the affected application. The attack can be launched remotely but requires user interaction to succeed. A public exploit has been released, and the vendor did not respond to disclosure attempts.
Critical Impact
Remote attackers can inject code through the filename argument in the showQuerySuccessPage function, leading to unauthorized code execution in the Electron renderer context when a user interacts with crafted input.
Affected Products
- sanjevirau gsubs 1.0.0
- sanjevirau gsubs 1.0.1 through 1.0.2
- sanjevirau gsubs 1.0.3
Discovery Timeline
- 2026-09-13 - CVE-2026-90491 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90491
Vulnerability Analysis
The vulnerability exists in the showQuerySuccessPage function defined in renderer/index.js of the gsubs Electron application. The function accepts a filename argument that is not properly sanitized before being processed in a context where it can be interpreted as executable code. Because the renderer process in Electron applications frequently has access to Node.js primitives or bridged APIs, code injection at this layer can escalate into broader access to the underlying host.
The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It reflects a broader pattern of injection weaknesses in Electron front-end code where DOM sinks, template interpolation, or dynamic script evaluation accept untrusted input. Refer to the GitHub CVE Documentation for a technical write-up.
Root Cause
The root cause is missing input neutralization on the filename parameter passed to showQuerySuccessPage. When the parameter reaches a downstream sink capable of interpreting content as code, an attacker-controlled payload is executed rather than treated as data. See the VulDB Vulnerability Report for additional context.
Attack Vector
Exploitation requires an attacker to deliver a crafted filename value to a target user and induce user interaction, such as opening a prepared link or file that triggers the vulnerable rendering path. Because delivery is network-reachable and no privileges are required, phishing or malicious content hosting are the most likely delivery methods. A proof-of-concept is available in the GitHub PoC Repository.
No verified code examples are provided. See the linked PoC repository for exploitation details.
Detection Methods for CVE-2026-90491
Indicators of Compromise
- Unexpected child processes spawned by the gsubs Electron application, particularly shell interpreters or scripting engines.
- Anomalous file writes or network connections originating from the gsubs renderer process.
- Crafted filenames containing JavaScript syntax, template literals, or shell metacharacters delivered to the application.
Detection Strategies
- Monitor process lineage for Electron-based applications and flag renderer processes launching interpreters like cmd.exe, powershell.exe, bash, or node.
- Inspect application logs for showQuerySuccessPage invocations with suspicious filename argument values.
- Deploy behavioral analytics that correlate user interaction events with subsequent code execution from the gsubs process tree.
Monitoring Recommendations
- Enable endpoint telemetry for the gsubs application binary and forward events to a centralized detection pipeline.
- Track outbound network activity from Electron renderer processes for beacon-like patterns.
- Alert on filesystem modifications in user-writable paths performed by the gsubs process shortly after file open events.
How to Mitigate CVE-2026-90491
Immediate Actions Required
- Restrict use of sanjevirau gsubs 1.0.3 and earlier until a patched release is available.
- Warn users against opening untrusted files or links that reference the gsubs application.
- Apply application allowlisting to prevent the gsubs renderer from spawning script interpreters.
Patch Information
The vendor was contacted about this disclosure but did not respond. No official patch has been published at the time of NVD publication. Monitor the VulDB CVE Details page for future vendor updates.
Workarounds
- Remove or disable the gsubs application in environments where it is not business-critical.
- Enforce Electron hardening practices such as disabling nodeIntegration and enabling contextIsolation in any local forks.
- Sanitize any filename values passed through automation or integrations that call into the gsubs interface.
# Configuration example
# Remove vulnerable application from managed endpoints (example for Linux)
sudo rm -rf /opt/gsubs
# Block execution via application control policy (example placeholder)
echo 'DENY /opt/gsubs/*' >> /etc/appcontrol/policy.d/gsubs.rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
