The Mattermost Desktop App up to version 5.13.3 does not enforce navigation restrictions for external links. When a user opens a link that points to an untrusted site, the app allows the site to supply a preload script, which runs with the full privileges of the desktop environment. This flaw could enable an attacker to execute arbitrary code in the user’s local machine, leading to disclosure of sensitive data, credential theft, or further compromise of the system. The weakness corresponds to improper restriction of native functionality (CWE‑829).

Affected by Mattermost. The Mattermost Desktop App versions 5.13.3 and earlier are vulnerable. The application runs on all platforms supported by the desktop client. No other vendors or products are listed. Updates or patches are not available for older or unsupported releases.

The CVSS base score of 4.6 indicates moderate risk, and the EPSS score below 1 % suggests that the vulnerability is unlikely to be exploited broadly at this time. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, which further reflects a low exploitation probability. Attackers would need a legitimate Mattermost account and a user click on a malicious link to launch the preload script, so the vector relies on social engineering or compromised content. The impact is limited to the device executing the desktop client.