CVE-2018-10994

PoC ×2—

CVSS 3.0

6.1 medium

EPSS

1%p70

Published

May 14, 2018 (May 14, 2018)

Modified

Jun 17, 2026

Description

js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.

Vendors: signal
Products: signal-desktop
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news1 stories

Another severe flaw in Signal desktop app lets hackers steal your chats in plaintext

The Hacker NewsMay 15, 00:00 UTC · May 15, 2018Exploit / PoC CVE-2018-10994 CVE-2018-11101

50