Riskcovery

CVE-2026-3471

Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

State
Published
Severity
6.5 Medium
Published
May 18, 2026
Updated
May 18, 2026
Reserved
Mar 3, 2026

Read the record on cve.org

Description

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HMattermost

Weaknesses

  • CWE-939 Improper Authorization in Handler for Custom URL Scheme

Affected Products

ProductVersions
MattermostMattermost
  • 6.0.1 and earlierAffected
  • 5.4.13 and earlierAffected
  • 6.2.0Not affected
  • 6.1.1.0Not affected
  • 5.13.5.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.