TI-2019-14393 Aliases CVE-2019-19954 GHSA-2gph-9fp2-pqq3

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating…

LOW 33CWE-427Published 2019-12-24 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.

Why it matters now

EPSS 0.00481 41st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:signal:signal-desktop::::::::	before 1.29.1	Vulnerable	Signal
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:signal:signal-desktop:*:*:*:*:*:*:*:* Versions before 1.29.1 Vulnerable ·Signal
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-19954
2026-10-03 Alias added: GHSA-2gph-9fp2-pqq3

References

Exploit 1

https://blog.mirch.io/2019/12/18/signal-desktop-windows-lpe/

Patch 1

https://github.com/signalapp/Signal-Desktop/commit/2da39cca673cc11be3c6d70d4fb95889f9ab6688

TI-2023-09843 Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify… CVSS 3.1HIGH 7.8
TI-2023-09844 Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain… CVSS 3.1LOW 3.3
TI-2019-07336 Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger… CVSS 3.0MEDIUM 6.5
TI-2018-07885 Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource… CVSS 3.0MEDIUM 6.1
TI-2018-07792 js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL. CVSS 3.0MEDIUM 6.1
TI-2018-10135 Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage. CVSS 3.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences