Read the docs
TI-2023-24758 Aliases CVE-2023-46116

Remote Code Execution via insufficiently sanitized call to shell.openExternal

Priority HIGH 75CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01258 69th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed tutanota (tutao): 3.118.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tutaotutanotabefore 3.118.123.118.12Patch availableCNA
  • tutanota Vendortutao Affected before 3.118.12 Fixed in 3.118.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tuta:tutanota:*:*:*:*:*:node.js:*:*before 3.118.12Vulnerabletutao
  • cpe:2.3:a:tuta:tutanota:*:*:*:*:*:node.js:*:* Versions before 3.118.12 Vulnerable ·tutao

Remediation

  • Fix · CNA tutanota (tutao) Fixed in 3.118.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46116

References

Exploit 2

Patch 1

Other 2

  • TI-2024-15432 Tuta loads images from external resources CVSS 3.1MEDIUM 5.3
  • TI-2024-15674 Attacker can prevent users from accessing received emails CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences