A high-severity local privilege escalation vulnerability in TradingView Desktop allows low-privileged attackers to execute arbitrary code with elevated permissions.

This vulnerability is caused by an uncontrolled search path element (CWE-427) within the Electron framework, which allows the application to load scripts from insecure locations. An authenticated local user with low privileges can exploit this flaw to execute code in the context of a higher-privileged user.

The ability for a local attacker to escalate privileges poses a significant risk to organizational security, as it facilitates full system compromise and unauthorized access to sensitive data processed within the application. With a CVSS score of 7.8, this vulnerability is classified as High, reflecting the potential for complete loss of confidentiality, integrity, and availability on the host machine.

Immediate Action: Monitor official TradingView security updates and apply the latest version as soon as a patch is released by the vendor.

Proactive Monitoring: Review system logs for unauthorized file access or unexpected process execution patterns originating from the TradingView installation directory.

Compensating Controls: Restrict local user write permissions on the directory paths used by the application to prevent the placement of malicious script files.

Public Exploit Available: Unknown.

Given the severity of potential privilege escalation, IT administrators should prioritize identifying all instances of the affected TradingView Desktop version within their environment. Once a vendor patch becomes available, it must be deployed immediately to prevent local attackers from abusing this search path flaw to gain administrative control over host systems.