CVE-2020-15258

In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by sending messages containing links with arbitrary protocols. The victim has to interact with the link and sees the URL that is opened. The issue was patched by implementing a helper function which checks if the URL's protocol is common. If it is common, the URL will be opened externally. If not, the URL will not be opened and a warning appears for the user informing them that a probably insecure URL was blocked from being executed. The issue is patched in Wire 3.20.x. More technical details about exploitation are available in the linked advisory.

• CWE-20

• https://benjamin-altpeter.de/shell-openexternal-dangers/Exploit, Third Party Advisory
• https://github.com/wireapp/wire-desktop/commit/b3705fffa75a03f055530f55a754face5ac0623bPatch, Third Party Advisory
• https://github.com/wireapp/wire-desktop/security/advisories/GHSA-5gpx-9976-ggpmExploit, Third Party Advisory
• https://benjamin-altpeter.de/shell-openexternal-dangers/Exploit, Third Party Advisory
• https://github.com/wireapp/wire-desktop/commit/b3705fffa75a03f055530f55a754face5ac0623bPatch, Third Party Advisory
• https://github.com/wireapp/wire-desktop/security/advisories/GHSA-5gpx-9976-ggpmExploit, Third Party Advisory

Published

Oct 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15252In XWiki before version 12.5 and 11.10.6, any user with SCRI…8.8
• CVE-2020-15253Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scri…4.8
• CVE-2020-15254Crossbeam is a set of tools for concurrent programming. In c…9.8
• CVE-2020-15255In Anuko Time Tracker before verion 1.19.23.5325, due to not…7.3
• CVE-2020-15256A prototype pollution vulnerability has been found in `objec…9.8
• CVE-2020-15257containerd is an industry-standard container runtime and is …5.2
• CVE-2020-15259ad-ldap-connector's admin panel before version 5.0.13 does n…8.8
• CVE-2020-1526An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15260PJSIP is a free and open source multimedia communication lib…6.8
• CVE-2020-15261On Windows the Veyon Service before version 4.4.2 contains a…6.7
• CVE-2020-15262In webpack-subresource-integrity before version 1.5.1, all d…3.7
• CVE-2020-15263In platform before version 9.4.4, inline attributes are not …6.1