Gather.town portal / Electron desktop — high-level

Archived vulnerability report about the Gather.town Electron clients (Windows, macOS, Linux). Severity framing in the source: P1 remote code execution class. Exploit payloads and reproduction steps are omitted.

Theme

Gather spaces support a portal tile that redirects users between in-product spaces under the Gather domain. Map maker / space URLs are involved in configuring where a portal sends someone. The desktop app loads web content with Electron preload behavior that historically bridged privileged APIs.

Root-cause concepts

• URL allowlisting gaps for portal destinations (hostname checks that are incomplete relative to how Electron opens windows)
• Preload scripts exposed toward page context; Node-related capabilities reachable when isolation settings are weak
• Dangerous webPreferences combinations in new windows (e.g. disabled sandbox / context isolation, enabled Node integration, relaxed web security) turn a navigation or script issue into host OS code execution

Impact (abstract)

If reachable, a malicious or compromised portal configuration could lead to remote code execution in the context of the desktop app user — full workstation impact, not merely in-browser XSS.

Mitigations / lessons

• Default Electron hardening: sandbox: true, contextIsolation: true, nodeIntegration: false; never disable webSecurity for untrusted content
• Do not export privileged Electron/Node bridges on window
• Strict allowlists for portal URLs (scheme, host, path); reject open redirects and non-product origins
• Treat map-maker input as untrusted; review desktop deep links the same way as web redirects
• Prefer opening external destinations in the system browser, not a privileged BrowserWindow

Reported responsibly in the source narrative after vendor coordination time had passed. Solve steps and PoC omitted.