CVE-2026-37281

@@ -1,6 +1,6 @@
 {
   "name": "zenshin",
-  "version": "2.6.4",
+  "version": "2.7.0",
   "description": "zenshin",
   "main": "./out/main/index.js",
   "author": "hitarth-gg",

@@ -3,7 +3,7 @@ import path, { join } from 'path'
 import { electronApp, optimizer, is } from '@electron-toolkit/utils'
 import icon from '../../resources/icon.ico?asset'
 import { Deeplink } from 'electron-deeplink'
-import { exec } from 'child_process'
+import { spawn } from 'child_process'
 import express from 'express'
 import cors from 'cors'
 import fs from 'fs'
@@ -14,6 +14,7 @@ import WebSocket from 'ws'
 import announce from '../../common/announce'
 import Settings from './settings'
 import { mkdirp } from 'mkdirp'
+import { cleanPath, validateStreamUrl } from '../renderer/src/utils/externalPlayer'
 
 let chalk
 import('chalk').then((module) => {
@@ -159,14 +160,28 @@ function createWindow() {
     shell.openExternal(authUrl) // Open the OAuth URL in the default browser
   })
 
-  ipcMain.on('open-vlc', (event, command) => {
-    exec(command, (error) => {
-      if (error) {
-        dialog.showErrorBox(
-          'Error launching External Player, make sure the path to .exe is correct. You can specify the correct path to it in the settings\n',
-          error.message
-        )
-      }
+  ipcMain.on('open-vlc', (event, player, url) => {
+    const cleanedPlayerPath = cleanPath(player)
+
+    if (validateStreamUrl(url) === false) {
+      dialog.showErrorBox(
+        'Invalid Stream URL',
+        'The provided stream URL is invalid. Please check the URL and try again.'
+      )
+      return
+    }
+
+    const vlc = spawn(cleanedPlayerPath, [url], {
+      shell: false,
+      detached: true,
+      stdio: 'ignore'
+    })
+
+    vlc.on('error', (error) => {
+      dialog.showErrorBox(
+        'Error launching External Player, make sure the path to .exe is correct. You can specify the correct path to it in the settings\n',
+        error.message
+      )
     })
   })
 
@@ -419,7 +434,7 @@ if (settings.get('downloadsFolderPath')) mkdirp(settings.get('downloadsFolderPat
 /* ------------------------------------------------------ */
 
 function startServer() {
-  backendServer = app2.listen(settings.get('backendPort'), () => {
+  backendServer = app2.listen(settings.get('backendPort'), '127.0.0.1', () => {
     console.log(`Server running at http://localhost:${settings.get('backendPort')}`)
   })
 
@@ -856,24 +871,24 @@ app2.get('/details/:magnet', async (req, res) => {
 // import { get } from 'http'
 // import { fileURLToPath } from 'url'
 // Full path to VLC executable, change it as needed
-const vlcPath = '"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe"' // Adjust this path as needed
+// const vlcPath = '"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe"' // Adjust this path as needed
 
-app2.get('/stream-to-vlc', async (req, res) => {
-  const { url, magnet } = req.query
+// app2.get('/stream-to-vlc', async (req, res) => {
+//   const { url, magnet } = req.query
 
-  if (!url) {
-    return res.status(400).send('URL is required')
-  }
-  const vlcCommand = `${vlcPath} "${url}"`
+//   if (!url) {
+//     return res.status(400).send('URL is required')
+//   }
+
+//   spawn(vlcPath.replace(/"/g, ''), [url], {
+//     shell: false,
+//     detached: true,
+//     stdio: 'ignore'
+//   })
+
+//   res.send('VLC launched successfully')
+// })
 
-  exec(vlcCommand, (error) => {
-    if (error) {
-      console.error(`Error launching VLC: ${error.message}`)
-      return res.status(500).send('Error launching VLC')
-    }
-    res.send('VLC launched successfully')
-  })
-})
 /* ------------------------------------------------------ */
 
 app2.delete('/remove/:magnet', async (req, res) => {

@@ -7,7 +7,7 @@ const api = {
   maximize: () => ipcRenderer.send('maximize-window'),
   close: () => ipcRenderer.send('close-window'),
   oauth: (url) => ipcRenderer.send('oauth-login', url),
-  openVlc: (url) => ipcRenderer.send('open-vlc', url),
+  openVlc: (player, url) => ipcRenderer.send('open-vlc', player, url),
   openAnimePahe: (url) => ipcRenderer.send('open-animepahe', url),
   windowReload: () => ipcRenderer.send('reload-window'),
   changeBackendPort: (port) => ipcRenderer.send('change-backend-port', port),

@@ -195,7 +195,7 @@ export default function Player(query) {
       streamUrl: `http://localhost:${backendPort}/streamfile/${encodeURIComponent(magnetURI)}/${encodeURIComponent(episode)}`,
       ...loc.state
     }
-    console.log(temp_obj);
+    console.log(temp_obj)
 
     window.api.saveToSettings('currentAnime', temp_obj)
 
@@ -222,7 +222,6 @@ export default function Player(query) {
     }
   }
 
-
   const handleStreamVlc = async (episode) => {
     // save the data in the settings
     let temp_obj = {
@@ -234,7 +233,8 @@ export default function Player(query) {
 
     try {
       window.api.openVlc(
-        `${vlcPath} http://localhost:${backendPort}/streamfile/${encodeURIComponent(magnetURI)}/${encodeURIComponent(episode)}`
+        vlcPath,
+        `http://127.0.0.1:${backendPort}/streamfile/${encodeURIComponent(magnetURI)}/${encodeURIComponent(episode)}`
       )
     } catch (error) {
       console.error('Error streaming to VLC', error)

@@ -39,7 +39,7 @@ export default function AppLayout({ props }) {
   /* ------------- CHECK LATEST GITHUB RELEASE ------------ */
   const owner = 'hitarth-gg' // Replace with the repository owner
   const repo = 'zenshin' // Replace with the repository name
-  const currentVersion = 'v2.6.4' // Replace with the current version
+  const currentVersion = 'v2.7.0' // Replace with the current version
 
   const getLatestRelease = async () => {
     try {

@@ -0,0 +1,26 @@
+export function cleanPath(path) {
+  return path.replace(/^"(.*)"$/, '$1')
+}
+
+export function validateStreamUrl(url) {
+  try {
+    const parsed = new URL(url)
+
+    // only allow HTTP
+    if (parsed.protocol !== 'http:') return false
+
+    // only allow localhost
+    if (parsed.hostname !== 'localhost' && parsed.hostname !== '127.0.0.1') {
+      return false
+    }
+
+    // cuz the backend serves the stream at /streamfile/:magnet/:episode
+    if (!parsed.pathname.startsWith('/streamfile/')) {
+      return false
+    }
+
+    return true
+  } catch {
+    return false
+  }
+}