Executive brief
The Offline Hospital Management System, a software tool used to manage patient records and hospital operations, contains a critical security flaw. This vulnerability allows an attacker to remotely execute commands on the computer running the software. If exploited, an attacker could gain full control over the system, potentially leading to the theft of sensitive patient data, disruption of hospital services, or the installation of ransomware.
Technical details
The Offline Hospital Management System version 5.3.0 is built on the Electron framework and is vulnerable to Remote Code Execution (RCE) due to insecure configuration of the renderer process. Specifically, the application enables 'nodeIntegration' while simultaneously disabling 'contextIsolation'. This combination allows any JavaScript executed within the renderer process to access powerful Node.js APIs. An attacker who can influence the content rendered by the application can leverage these APIs to execute arbitrary operating system commands with the privileges of the application user. This is a classic Electron security misconfiguration that bypasses the intended sandbox.
Affected products
- Silverplugins21 Offline Hospital Management System 5.3.0
Timeline
- 2026-05-18: disclosed: CVE published to NVD