Little write-up for a patched WebSocket-based RCE I found in the CurseForge launcher.

It involved an unauthenticated local websocket API reachable from the browser, which could be abused to execute arbitrary code.

Happy to answer any questions if anyone has any!