HOW TO GAIN CODE EXECUTION ON MILLIONS OF PEOPLE AND HUNDREDS OF POPULAR APPS

Summary from the TLDR Web Dev newsletter

A security researcher discovered a vulnerability in todesktop, an Electron app bundler service, that could allow remote code execution on millions of users of popular applications like ClickUp, Cursor, and Linear. The researcher found hardcoded Firebase credentials and secrets within todesktop's deployment pipeline, letting them push malicious auto-updates to any application using the service. They promptly reported the issue to todesktop, who quickly implemented a fix involving a privileged sidecar for signing and uploading.