GoldenDict Exposed Dangerous Method Vulnerability Allowing File Access and Modification

A vulnerability exists in GoldenDict versions 1.5.0 and 1.5.1, where an exposed dangerous method allows for reading and modifying files on the user's system. This issue arises when a user adds a crafted dictionary, particularly in the XDXF format, and searches for terms included in that dictionary. The vulnerability is exacerbated by a lack of proper sanitization of XML content, insufficient restrictions on executing JavaScript, and a weak Content Security Policy.

Impact

Exploitation of this vulnerability allows for unauthorized access to read and modify files on the user's file system.

Reproduction

To reproduce this vulnerability, add a malicious dictionary in the XDXF format to GoldenDict 1.5.0 or 1.5.1. After the dictionary is loaded, search for any term included in the malicious dictionary. The embedded JavaScript in the dictionary's XML markup will execute, accessing and potentially modifying user files.