Electron AppleScript Injection Vulnerability in app.moveToApplicationsFolder on macOS

A vulnerability in Electron's app.moveToApplicationsFolder() function on macOS prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8 allows for arbitrary execution of AppleScript. This issue arises because the function's fallback path does not correctly manage certain characters in the application bundle path. If an application using this API is tricked into accepting the move-to-Applications prompt, it could execute crafted AppleScript commands.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of AppleScript, potentially allowing for manipulation of the user's system or applications.

Remediation

Users must update to Electron versions 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8 to address this vulnerability.