Update May 21, 2026: The vulnerability was fixed on the website a bit ago. They also released v3.32.0 of Scratch Desktop, which is intended to fix this bug. Update May 6, 2026: Scratch expanded their server-side filtering to hopefully prevent uploading new malicious projects to the Scratch website, with more permanent fixes in various stages of development. No fix is available for Scratch Desktop…
Scratch has a long history of SVG-related vulnerabilities. The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations (eg. measuring SVG bounding box in a more reliable way than viewbox or width/height). No matter how briefly the SVG remains in the main document, this is an…
This was a somewhat big deal in some Scratch community bubbles in May 2024, but there's very little documentation about it on the open internet. Felt reasonable to put something on this blog about that time Blocklive became malware. I'm also including some other security and privacy issues that were discovered at the same time. My reaction at the time to this was a bit emotional. I'll try to keep…
This blog post discloses a critical security vulnerability in Paper.js - a popular JavaScript library for rendering and manipulating vector images. Responsible disclosure Emails to the only Paper.js maintainer with any online activity were ignored for over a year. Paper.js has been unmaintained for two years, so I assume that the maintainer has moved on. The most popular Paper.js app I'm aware of…
I've been a customer of Migadu email for over two years. I do not recommend Migadu and intend to move to a competing service in the near future. My needs I use Migadu as an individual. My personal domain (the one you're reading this on) and TurboWarp (an open source project I started) both use it. Some other side projects have used it at various points. I am not a high traffic email user. 90% of…
This post takes place in a fantasy dream world. Any resemblance to real apps is entirely coincidental. Consider a world with just two Electron apps (that's how you know this is a fantasy). Let's call them App A and App B. To the user, both apps feel quite similar. One might even be 90% based on the other. Despite the external similarities, the apps tackle their Electron security configuration in a…
I designed the capture-the-flag (CTF) event at MinneHack 2026 . The code has been posted on GitHub , though that repository is not really in an easy to play with format. This post is the writeup for almost all of puzzles so you can try them yourself (or at least think about them) along with the solution. Several parts of this event involved server-side stuff that is no longer running, so for those…
Last fall, we built Bananatron , a black-box auditing framework for Electron apps. We used Bananatron to audit 112 popular Electron apps and discovered several real-world vulnerabilities. We also found that the overall landscape of Electron app security is overwhelmingly poor. A majority of apps enable insecure Electron features that automatically escalate common web vulnerabilities into…