Remote Code Execution in Slack desktop apps + bonus

With any in-app redirect - logic/open redirect, HTML or javascript injection it's possible to execute arbitrary code within Slack desktop apps. This report demonstrates a specifically crafted exploit consisting of an HTML injection, security control bypass and a RCE Javascript payload. This exploit …

{"full":"<p>content<\/p>","preview":"<p>content<\/p>"}