CVE-2026-115904
OS command injection in Topluyo Desktop for Linux before 2026.9.2410
- CVSS 3.1
- 9.6 critical
- EPSS
- <1%p55
- Published
- ·
- Modified
Topluyo Desktop for Linux unsafely processes user-controlled URLs in openExternalLinks() in utils.js, causing OS command injection. A remote attacker who controls a target URL can run arbitrary commands as the user running the app when that user opens the link. Linux installs before 2026.9.2410 are affected.
What to do: Upgrade Topluyo Desktop for Linux to version 2026.9.2410.
| Product | Affected | Fixed in |
|---|---|---|
| Topluyo Desktop for Linux | prior to 2026.9.2410 | 2026.9.2410 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.