CVE-2026-90491
Received Received - Intake

Code Injection in Sanjevirau Gsubs Electron App

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90491
EUVD
EUVD-2026-76933

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sanjevirau gsubs 1.0.3
electron electron 9.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in the sanjevirau gsubs application up to version 1.0.3. It exists in the Electron component's renderer/index.js file. The issue allows manipulation of the filename argument in the showQuerySuccessPage function, leading to code injection. The attack can be executed remotely and a public exploit is available.

Detection Guidance

Check if your system runs gsubs up to version 1.0.3 or Electron 9.1.2 with nodeIntegration enabled and context isolation disabled. Inspect network traffic for subtitle filenames containing HTML markup or suspicious characters. Review renderer/index.js for unescaped filename rendering in showQuerySuccessPage.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system. This could allow them to install malware, steal data, or take control of your computer. The attack starts by uploading a malicious subtitle filename to the OpenSubtitles API, which when processed by the vulnerable application, runs the injected code in your local context.

Compliance Impact

This vulnerability could lead to data breaches, which would violate GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this software may face compliance violations, legal penalties, and reputational damage if user data is compromised through this exploit.

Mitigation Strategies

Upgrade gsubs to the latest version and Electron to a patched version disabling nodeIntegration and enabling context isolation. Sanitize all external data like filenames before DOM insertion. Add a Content-Security-Policy to restrict script execution. Monitor for unusual file writes or command executions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90491. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart