For anyone triaging this: the risk is a classic 'unsafe URL string passed to a shell context' bug — the fix is to never use OS shell for URL opening at all, use the platform URI API with strict scheme allowlist (http/https only) and reject anything else before it reaches the desktop environment. Also worth verifying whether the 'Read More' link is user-controlled content (e.g. from a signed message or memo) vs wallet-generated — that determines if this is exploitable remotely or requires prior UI interaction.
For anyone triaging this: the risk is a classic 'unsafe URL string passed to a shell context' bug — the fix is to never use OS shell for URL opening at all, use the platform URI API with strict scheme allowlist (http/https only) and reject anything else before it reaches the desktop environment. Also worth verifying whether the 'Read More' link is user-controlled content (e.g. from a signed message or memo) vs wallet-generated — that determines if this is exploitable remotely or requires prior UI interaction.