element-hq / element-hq/element-web

Element Windows lets Python, PHP, EXE scripts execute with no warning

Open
#32,091 7 comments 0 reactions 0 assignees View on GitHub
A-Electron A-File-Download A-Privacy O-Occasional S-Major T-Defect
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

### Steps to reproduce

Similar to WhatsApp & Telegram for Windows , I beleive this issue applies on Element as well.

https://www.bleepingcomputer.com/news/security/whatsapp-for-windows-lets-python-php-scripts-execute-with-no-warning/

Element Windows allows sending Python , PHP and EXE attachments that are executed without any warning when the recipient opens them.

### Outcome

Several solutions can be considered:
1. Warn the user that this file may be dangerous
2. Mark the file as coming from the internet
3. Prevent the user from opening the file directly
etc

### Operating system

Windows

### Application version

_No response_

### How did you install the app?

_No response_

### Homeserver

_No response_

### Will you send logs?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.