HackerOne Disclosed Reports - 2026-10-24

Low
resolved

Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process

Bug reported by was disclosed at October 24, 2026, 9:16 pm   |   Code Injection

A code injection vulnerability was discovered in Nextcloud Desktop Client version 33.0.5 for macOS. The vulnerability combined two weaknesses: the QtWebEngineProcess binary was shipped with library validation disabled, and it contained dead build-server paths in its rpath that were searched before legitimate framework directories. An unprivileged local attacker could mount a disk image and plant a malicious library at the expected path, allowing arbitrary code execution in the web renderer process without administrator privileges. This could have resulted in credential theft, file access, and persistence mechanisms.