# RCE via Print function [Simplenote 1.1.3 - Desktop app]

Stored XSS in Simplenote 1.1.3 desktop print view escalates to RCE via Electron's process.binding('process_wrap') spawning arbitrary binaries.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: luigigubello
- Disclosed: 2018-07-26
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/358049
- Library page: https://bugbountylibrary.com/r/h1%3A358049
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high tech:electron technique:chained technique:source-review vuln:rce vuln:xss

**Target:** Electron desktop app print/PDF rendering of note content
**Root cause:** Note content is rendered unsanitized in the print view, allowing HTML/JS injection; the renderer has Node integration exposing process.binding('process_wrap').Process.spawn, so injected JS executes OS commands.
**Steps:**
1. Install Simplenote 1.1.3 desktop, ensure Markdown is disabled.
2. Create note with `">'><details/open/ontoggle=confirm('XSS')>` and use File --> Print; alert fires.
3. Replace payload with `">'><img src=x onerror=writeln(String.fromCharCode(...))>` where the char codes encode a script calling `process.binding('process_wrap').Process` and `proc.spawn({file:'/usr/bin/gnome-calculator',...})`.
4. Print the note (or save as PDF); gnome-calculator launches.
**How found:** Built on ysx's prior report #291539 showing XSS in the print function; reused his XSS-to-RCE PoC and encoded the spawn script with String.fromCharCode to evade filters.
**Exploitation:** Attacker shares a note containing the encoded payload; victim opens Print/Save-as-PDF, the injected onerror handler runs in the Electron renderer with Node access and spawns an arbitrary binary (demonstrated with gnome-calculator).
**Escalation:** Chains stored XSS in print view with Electron Node integration to go from JS execution to OS command execution.
**Insight:** Desktop Electron apps that render user content in auxiliary views (print/PDF) often keep Node integration enabled there; test print/export paths, not just the main editor, for XSS that reaches process.binding.