{"id":"CVE-2026-115904","published":"2026-10-28T13:17:05.400","lastModified":"2026-10-28T15:24:56.033","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7","tags":[]}],"exploitRefs":[{"url":"https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7","tags":[]}],"hasPoc":true,"ai":{"summary":"A URL handling flaw in Topluyo Desktop for Linux before 2026.9.2410 allows remote attackers to trigger OS command injection by supplying a malicious URL that the app opens via its openExternalLinks() function, leading to arbitrary code execution with the user's privileges.","exploitability":"Exploitation requires the target user to click or otherwise interact with a malicious link provided by an attacker (e.g., via chat, email, or website), as the vulnerable function only executes when the user triggers it.","blast_radius":"Successful exploitation grants attackers full control over the victim's system under the user's account, enabling data theft, lateral movement, or deployment of malware.","remediation":"Upgrade Topluyo Desktop for Linux to version 2026.9.2410 or later, which patches the unsafe URL handling in openExternalLinks().","detection":"No reliable host or network indicator is derivable from the published description.","tags":["command-injection","desktop-app","linux","social-engineering"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:44:35.463Z"}}