OS command injection in Topluyo Desktop for Linux via external links
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Topluyo Desktop for Linux before 2026.9.2410 is affected. User-controlled URLs are processed unsafely by the openExternalLinks() routine in utils.js, which allows OS command injection (CWE-78). An attacker who controls a target URL can run arbitrary operating system commands with the privileges of the user running the application when that user opens the link.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update Topluyo Desktop for Linux to version 2026.9.2410, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA App (topluyo) Fixed in 2026.9.2410
Timeline
- 2026-10-28 Threatist record created from CVE-2026-115904
- 2026-11-03 CISA SSVC decision points changed
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences