PT-2025-20578 · Jan · Jan

Published 2025-05-09 · Updated 2025-12-27 · CVE-2025-29509

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jan versions 0.5.14 and earlier

Description The software is susceptible to remote code execution (RCE) when a user clicks on a link displayed within a conversation. This occurs because the application opens external websites and exposes the electronAPI, specifically lacking URL filtering when calling the shell.openExternal() function.

Recommendations Versions prior to 0.5.14 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

CVE-2025-29509

Affected Products

Jan

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-29509 · Security Note
• https://t.me/cvedetector/24960 · Telegram Post
• https://twitter.com/cybercronai/status/1921279534839521686 · Twitter Post
• https://twitter.com/cybercronai/status/1921212468656853472 · Twitter Post
• https://twitter.com/CVEnew/status/2005031837236678947 · Twitter Post
• https://gist.github.com/Suuuuuzy/b8fa2fa083793c460e3686c182f8c4d1 · Note
• https://drive.google.com/file/d/1qDztNtn2merSjYgPRLWFFXqlXM9tcrjD/view?usp=sharing · Note
• https://t.me/cvetracker/23501 · Telegram Post
• https://twitter.com/SecAideInfo/status/1921872086567407768 · Twitter Post