CVE-2024-21625

SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized properly in all cases, a one-click remote code execution can be achieved in cases when a device is connected, the user is presented with a malicious link and clicks it from within the application. As of version 0.10.35, the custom protocol links within the electron application are now being parsed and sanitized properly.

• CWE-20

• https://github.com/SideQuestVR/SideQuest/security/advisories/GHSA-3v86-cf9q-x4x7Vendor Advisory
• https://github.com/SideQuestVR/SideQuest/security/advisories/GHSA-3v86-cf9q-x4x7Vendor Advisory

Published

Jan 4, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21619A Missing Authentication for Critical Function vulnerability…7.5
• CVE-2024-2162An OS Command Injection vulnerability in Kiloview NDI allows…8.8
• CVE-2024-21620An Improper Neutralization of Input During Web Page Generati…6.1
• CVE-2024-21622Craft is a content management system. This is a potential mo…8.8
• CVE-2024-21623OTCLient is an alternative tibia client for otserv. Prior to…9.8
• CVE-2024-21624nonebot2 is a cross-platform Python asynchronous chatbot fra…6.5
• CVE-2024-21626runc is a CLI tool for spawning and running containers on Li…8.6
• CVE-2024-21627PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21628PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21629Rust EVM is an Ethereum Virtual Machine interpreter. In `rus…7.5
• CVE-2024-2163The Ninja Beaver Add-ons for Beaver Builder plugin for WordP…6.4
• CVE-2024-21630Zulip is an open-source team collaboration tool. A vulnerabi…4.3