CVE-2025-14498
Unknown Unknown - Not Provided
Uncontrolled Search Path Vulnerability in TradingView Desktop Electron

Publication date: 2025-12-23

Last updated on: 2025-12-23

Assigner: Zero Day Initiative

Description
TradingView Desktop Electron Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TradingView Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the Electron framework. The product loads a script file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27395.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-23
Last Modified
2025-12-23
Generated
2026-05-07
AI Q&A
2025-12-24
EPSS Evaluated
2026-05-05
NVD
CVE-2025-14498
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
electron electron *
tradingview desktop *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in TradingView Desktop's Electron framework involves an uncontrolled search path where the application loads a script file from an unsecured location. A local attacker who can already execute low-privileged code on the system can exploit this flaw to escalate their privileges and execute arbitrary code with higher privileges.


How can this vulnerability impact me? :

The vulnerability can allow a local attacker to escalate their privileges on the affected system, potentially gaining higher-level access than intended. This can lead to unauthorized code execution, compromising the security and integrity of the system and data.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart