Soda PDF Desktop Remote Code Execution Vulnerability Due to Insufficient UI Warning in Launch Action

A remote code execution vulnerability has been identified in Soda PDF Desktop. This issue arises from the Launch action's implementation, which allows the execution of potentially harmful scripts without adequate user notification. Exploitation of this vulnerability requires user interaction, as the target must open a malicious file or visit a harmful webpage. Once exploited, the arbitrary code is executed in the context of the user.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the current user's privileges.

Remediation

Given the nature of this vulnerability, the recommended mitigation strategy is to limit interactions with the affected product.