Jianjia Yu

An OS command injection flaw exists in the Open in Editor Handler component. The issue occurs within the `openDevTools()` function located in the `electron/window.js` file, where improper handling of the `host` argument allows for remote attack execution.

AFFiNE is an open-source workspace and operating system. Versions prior to 0.25.4 contain a one-click remote code execution issue. An attacker can exploit this by embedding a specially crafted `affine:` URL on a website. Exploitation occurs when a victim visits a malicious website that redirects to the URL, or clicks a crafted link on a legitimate website. This triggers the AFFiNE custom URL handler, launching the application and processing the URL, resulting in arbitrary code execution on the victim’s machine without further interaction.