CVE-2026-100230
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
Schwachstellenklasse
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
Quellen
- https://github.com/deskflow/deskflow/security/advisories
- https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp
- https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp
- https://github.com/input-leap/input-leap/releases
- https://nvd.nist.gov/vuln/detail/CVE-2021-42072
- https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.