{"id":"CVE-2026-115904","aliases":["EUVD-2026-112059","GHSA-vrrv-3f46-c3x7"],"status":"published","title":"Topluyo Desktop for Linux has an OS Command Injection issue","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00743,"percentile":0.55206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2026-10-28T12:55:04Z","modified":"2026-11-03T13:17:19Z","exploits":[{"source":"pocgithub","id":"VulnSVNC/CVE-2026-115904","title":"VulnSVNC/CVE-2026-115904","date":"2026-11-02","url":"https://github.com/VulnSVNC/CVE-2026-115904"}],"products":[{"vendor":"topluyo","product":"app"},{"vendor":"tuya","product":"app"}],"references":[{"url":"https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115904.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115904","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-115904","title":"Topluyo Desktop for Linux has an OS Command Injection issue","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","status":"published","published":"2026-10-28T12:55:04.432Z","modified":"2026-11-03T12:56:07.973Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-03T13:57:27.751141Z"}],"euvd":[{"id":"EUVD-2026-112059","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","status":"published","published":"2026-10-28T12:55:04Z","modified":"2026-11-03T12:56:07Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T15:18:11.183334Z"}],"nvd":[{"id":"CVE-2026-115904","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","status":"published","published":"2026-10-28T13:17:05.4Z","modified":"2026-11-03T13:17:19.633Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-03T18:16:46.837221Z"}],"osv":[{"id":"CVE-2026-115904","title":"Topluyo Desktop for Linux has an OS Command Injection issue","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","status":"published","published":"2026-10-28T12:55:04.432Z","modified":"2026-11-05T02:30:32.040335344Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-07T03:08:00.941926Z"}]}}