Security: Flask backend runs on localhost but accessible to any process on the machine, allows local privilege escalation

[anshul23102]

Problem

Flask backend bound to 127.0.0.1 but any local process can access it. Malicious app can execute scripts as the user.

---

Recommended Solution

Use Unix socket for Electron communication:

const net = require('net');
const fs = require('fs');

function createUnixSocket() {
  const socketPath = path.join(os.tmpdir(), `devshell-${process.pid}.sock`);
  
  // Clean up old socket
  try { fs.unlinkSync(socketPath); } catch {}
  
  return socketPath;
}

const socketPath = createUnixSocket();
const server = net.createServer();
server.listen(socketPath);

---

Program Template

• GSSoC '26

---

Suggested Labels

security, privilege-escalation, ipc, gssoc-eligible
EOF
)

[anshul23102]

@siddu-k Contributing under GSSoC '26. This prevents local privilege escalation via Unix socket IPC. Request assignment under GSSoC '26. 🔐