A persistent cross-site scripting vulnerability in Freeter version 1.2.1 enables remote code execution, posing a critical security risk to user workstations.

This is a persistent cross-site scripting (CWE-79) vulnerability where an attacker can inject malicious scripts into custom widget titles or files. When a victim interacts with these objects, the payload executes in the context of the application, which may allow an attacker to achieve remote code execution on the host machine.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the application. This could lead to full system compromise, theft of sensitive project data, or unauthorized access to internal resources. Given the CVSS score of 7.2, this vulnerability is categorized as High severity and requires immediate attention to prevent potential data breaches or operational disruption.

Immediate Action: There is currently no official patch available from the vendor for this specific version. Users should restrict the use of custom widgets and avoid opening untrusted project files until a secure version is released.

Proactive Monitoring: Security teams should monitor workstation endpoint logs for unusual child processes spawned by the Freeter application, such as command shells or unauthorized network connections.

Compensating Controls: Since this is a client-side application, standard web application firewalls are ineffective; however, deploying endpoint detection and response (EDR) solutions can help identify and block suspicious process execution chains initiated by the software.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Exploit-DB entry 49833.

The presence of a functional proof-of-concept that demonstrates remote code execution elevates the urgency of this advisory. Organizations using Freeter 1.2.1 should treat this as a high-priority risk and implement strict access controls regarding project file imports. Users are advised to monitor the vendor website for security updates and apply them immediately upon release to remediate this flaw.