Security vulnerabilities and automated fixes for update security issues
1 post found
A critical vulnerability in `server.js` allowed the application to fetch update manifests over unencrypted HTTP connections, opening the door to man-in-the-middle attacks that could serve malicious update payloads. The fix enforces HTTPS-only connections by tightening a single regular expression in the `readUpdateManifest` function. This change closes an attack vector that could have led to remote code execution via a trojanized installer.