Command Execution Vulnerability in Super Productivity Todo List App by Super Productivity

CVE-2026-71551

What is CVE-2026-71551?

The Super Productivity app contains a command execution vulnerability that arises from the EXEC IPC handler's ability to accept command strings for execution without adequate permissions. Prior to version 18.13.0, this handler could be exploited via renderer code, including community plugins, enabling commands to execute with elevated privileges. A confirmation dialog is shown only on the first execution, and the default settings allow commands to be silently executed later on. This could lead to unauthorized actions if an attacker gains access to the execution channel.

References