Description
The launcher window runs with nodeIntegration: true and sandbox: false as documented in the inline comment.
This means any JavaScript executing in that renderer (including third-party Raycast extensions) has unrestricted
access to Node.js APIs — fs, child_process, crypto, etc. If an extension contains an XSS vulnerability, or if
an attacker compromises a Raycast store extension, they gain full filesystem and process access on the host machine.
Electron's official security documentation explicitly warns against this configuration. The recommended approach
is to use contextBridge + preload scripts to expose only the specific APIs extensions need, rather than
granting blanket Node access.
The SECURITY.md mentions an "Electron Security Architecture" section but does not disclose this risk.
Severity: high
File: vite.config.ts
Expected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.
Description
The launcher window runs with
nodeIntegration: trueandsandbox: falseas documented in the inline comment.This means any JavaScript executing in that renderer (including third-party Raycast extensions) has unrestricted
access to Node.js APIs — fs, child_process, crypto, etc. If an extension contains an XSS vulnerability, or if
an attacker compromises a Raycast store extension, they gain full filesystem and process access on the host machine.
Electron's official security documentation explicitly warns against this configuration. The recommended approach
is to use
contextBridge+preloadscripts to expose only the specific APIs extensions need, rather thangranting blanket Node access.
The SECURITY.md mentions an "Electron Security Architecture" section but does not disclose this risk.
Severity:
highFile:
vite.config.tsExpected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.