Posix

The issue is related to insufficient escaping in markdown "code highlighting" in the wire-webapp, which allows the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim, allowing the attacker to fully control the user account. Wire-desktop clients connected to a vulnerable wire-webapp version are also vulnerable to this attack.

The issue is related to prototype pollution, which affects the pathval package. This type of issue can occur when an application does not properly validate user input, allowing an attacker to pollute the prototype of an object, potentially leading to security vulnerabilities.

The issue affects the json-pointer package, where multiple references of an object using a slash are supported.