OS Command Injection Vulnerability in Topluyo Desktop for Linux
CVE-2026-115904

9.6CRITICAL

Key Information:

Vendor

Topluyo

Status
App
Vendor
CVE Published:
28 October 2026

What is CVE-2026-115904?

A security flaw has been identified in Topluyo Desktop for Linux prior to version 2026.9.2410, where user-controlled URLs can be exploited. This vulnerability allows an attacker to inject and execute arbitrary operating system commands through the 'openExternalLinks()' function in the 'utils.js' file. If a user opens a malicious link, the attacker can gain control over the system with the same privileges as the user running the application. Users are advised to update to version 2026.9.2410 to mitigate this risk.

Affected Version(s)

App < 2026.9.2410

References

https://github.com/topluyo/App/security/advisories/GHSA-v...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.