Executive brief
AntSword is a toolkit used by developers and security professionals to manage websites and servers. A security flaw in its terminal component allows a malicious server to send specially crafted data that appears as a clickable link to the user. If a user clicks this link, the attacker can execute arbitrary commands on the user's local computer, potentially leading to full system compromise and data theft.
Technical details
The vulnerability exists in the noxss() sanitization function within source/app.entry.js, which fails to filter square brackets ([]) used by the jquery.terminal library for text formatting. An attacker-controlled server can return a payload containing jquery.terminal format codes that include a 'javascript:' URI scheme. Because the AntSword Electron application is configured with 'nodeIntegration: true', clicking the rendered link allows the execution of arbitrary Node.js code (e.g., require('child_process').exec()). The attack requires a single user interaction (1-click) to trigger the malicious link within the virtual terminal. The issue is resolved in version 2.1.16 by expanding the sanitization logic.
Affected products
- AntSwordProject AntSword <= 2.1.15
Timeline
- 2026-04-27: advisory: GitHub security advisory published by Medicean
- 2026-05-12: disclosed: CVE-2026-43892 published to NVD