CVE-2026-26462

7.3 HIGH

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration

Published: 2026-05-18 · Last updated: 2026-05-20

Severity and scoring

CVSS: 7.3 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-917

Description

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrary operating system commands.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-11561 — Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in S... (9.8 CRITICAL)
CVE-2026-40985 — Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions (6.4 MEDIUM)
CVE-2026-41729 — Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-pat... (8.1 HIGH)
CVE-2026-41719 — A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query met... (6.4 MEDIUM)
CVE-2026-41717 — Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability (8.1 HIGH)