Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M
CVE-2026-115904Topluyo Desktop for Linux has an OS Command Injection issue
Critical 9.6
In plain English
A critical-severity OS command injection in App from topluyo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7 x_refsource_CONFIRM