What’s Vulnerable › Vulnerabilities

CVE-2024-21625: One-click remote code execution via malicious deep link

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-04 · updated 2026-06-17
• Weakness: CWE-20

Description

SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized properly in all cases, a one-click remote code execution can be achieved in cases when a device is connected, the user is presented with a malicious link and clicks it from within the application. As of version 0.10.35, the custom protocol links within the electron application are now being parsed and sanitized properly.

Affected products

• SideQuestVR SideQuest: before 0.10.35 — fixed in 0.10.35

How to fix

Upgrade to a fixed version: SideQuestVR SideQuest 0.10.35. Check the vendor advisory for mitigations.

References

• https://github.com/SideQuestVR/SideQuest/security/advisories/GHSA-3v86-cf9q-x4x7
• https://github.com/SideQuestVR/SideQuest/security/advisories/GHSA-3v86-cf9q-x4x7

Get alerted when CVE-2024-21625 or the next vulnerability affects your stack