CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

What is CVE-2026-3471?

CVE-2026-3471 is a medium-severity denial of service vulnerability in Mattermost, published on 18 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618

Weakness: CWE-939

Which versions are affected by CVE-2026-3471?

It affects 1 product.

Products include Mattermost Mattermost Desktop.

How do I fix CVE-2026-3471?

No fix has been published for CVE-2026-3471 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-3471 being exploited?

There is no known exploitation of CVE-2026-3471 in the wild and no public exploit code.

Other vulnerabilities in Mattermost

• CVE-2016-11064 Code injection in n/a Critical 9.8
• CVE-2019-20856 Code injection in n/a Critical 9.8
• CVE-2019-20861 Code injection in n/a High 8.8
• CVE-2026-1046 Arbitrary application execution via unvalidated server-controlled URLs in Help menu High 7.6
• CVE-2020-14456 Security feature bypass in n/a High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fhqj-97rr-gvhp.