This vulnerability exists in sanjevirau gsubs up to version 1.0.3 in the showQuerySuccessPage function of renderer/index.js in the Electron component. An attacker can remotely manipulate the filename argument to perform code injection. The exploit is publicly available, and the vendor has not issued a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote code injection via manipulation of the filename argument, potentially enabling execution of arbitrary code. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. No known active exploitation in the wild has been reported.

No official fix or patch is currently available, and the vendor has not responded to the disclosure. Users should consider avoiding use of affected versions (=1.0.0, =1.0.1, =1.0.2, =1.0.3) until a vendor patch or official guidance is provided. Monitor for updates from the vendor or community for remediation.