Mattermost Desktop App fails to validate URLs that are loaded in a pop‑up window. A malicious server can supply a URL such as {{window.open('javascript:alert()');}}, which is parsed as a JavaScript URL and causes the application to crash. The flaw is identified as CWE‑939 (Improper Validation of URL). The impact is a loss of availability for the affected instance of the Desktop App, but there is no evidence of data disclosure or privilege escalation.

Mattermost Desktop App versions up to 6.1, including 6.0.1 and 5.4.13.0. The issue appears only in these older releases; all newer releases contain a patch that prevents invalid URLs from being opened.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a remote attacker controlling a server that hosts a link containing the malicious URL – the Desktop App will load it in a pop‑up window and crash. The vulnerability is straightforward to exploit once the attacker can direct a user to the crafted link, and the result is a denial of service to the affected instance. Because the flaw only crashes the application, it is less critical than a data breach but still significant because it can disrupt operations.