CVE-2026-90491

Name of the Vulnerable Software and Affected Versions sanjevirau gsubs versions prior to 1.0.4

Description A remote code injection flaw exists within the Electron component in the renderer/index.js file. The issue occurs in the showQuerySuccessPage() function when the filename argument is manipulated, allowing an attacker to execute arbitrary code remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the showQuerySuccessPage() function to minimize the risk of exploitation.