{"id":"CVE-2026-3471","aliases":["EUVD-2026-30757","GHSA-fhqj-97rr-gvhp"],"status":"published","title":"Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App","description":"Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00184,"percentile":0.08035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-939"],"published":"2026-05-18T08:45:44Z","modified":"2026-10-28T02:31:13Z","products":[{"vendor":"mattermost","product":"mattermost"},{"vendor":"mattermost","product":"mattermost_desktop"}],"references":[{"url":"https://mattermost.com/security-updates","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3471","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fhqj-97rr-gvhp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3471.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-3471","title":"Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App","description":"Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618","status":"published","published":"2026-05-18T08:45:44.576Z","modified":"2026-05-18T14:35:23.933Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-30757","description":"Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618","status":"published","published":"2026-05-18T08:45:44Z","modified":"2026-05-18T14:35:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:21:16.184545Z"}],"ghsa":[{"id":"GHSA-fhqj-97rr-gvhp","title":"Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading...","description":"Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618","status":"published","published":"2026-05-18T09:31:48Z","modified":"2026-05-18T09:31:55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T15:08:11.468783Z"}],"nvd":[{"id":"CVE-2026-3471","description":"Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618","status":"published","published":"2026-05-18T09:16:22.847Z","modified":"2026-06-17T10:43:38.35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-3471","title":"Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App","description":"Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618","status":"published","published":"2026-05-18T08:45:44.576Z","modified":"2026-10-28T02:31:13.674546421Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-939"],"updated_at":"2026-11-02T15:45:02.247031Z"}]}}