element-hq / element-hq/element-web
Element Windows lets Python, PHP, EXE scripts execute with no warning
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
Similar to WhatsApp & Telegram for Windows , I beleive this issue applies on Element as well.
https://www.bleepingcomputer.com/news/security/whatsapp-for-windows-lets-python-php-scripts-execute-with-no-warning/
Element Windows allows sending Python , PHP and EXE attachments that are executed without any warning when the recipient opens them.
### Outcome
Several solutions can be considered:
1. Warn the user that this file may be dangerous
2. Mark the file as coming from the internet
3. Prevent the user from opening the file directly
etc
### Operating system
Windows
### Application version
_No response_
### How did you install the app?
_No response_
### Homeserver
_No response_
### Will you send logs?
No
Contributor guide
Assessment
This issue has not been assessed yet.