GHSA-v3wr-67px-44xg: 
JavaScript vulnerability analysis and mitigation

A high-severity security vulnerability (GHSA-v3wr-67px-44xg) was identified in the arc-electron package, specifically affecting versions below 0.1.10 of @advanced-rest-client/base npm package. The vulnerability was disclosed on March 2, 2022, and involves execution with unnecessary privileges in the application (GitHub Advisory).

The vulnerability is classified as CWE-250 (Execution with Unnecessary Privileges). When users click on a response header containing a link, the target opens in a new ARC window with the default preload script loaded. This configuration allows embedded scripts in the link target to execute logic with ARC's renderer process privileges (GitHub Advisory).

The vulnerability enables unauthorized access to sensitive system resources through the renderer process. This includes access to the file system, data store (which may contain sensitive information), and additional processes that should be restricted to ARC's use only (GitHub Advisory).

The vulnerability has been patched in version 17.0.9 of the software. As a temporary workaround, users are advised to avoid clicking on any links in the response headers view until they can update to the patched version (GitHub Advisory).