{"id":"CVE-2026-115904","revision":"33c3c22f4ef24305aea2d0fe32993121","records":[{"revision":"33c3c22f4ef24305aea2d0fe32993121","observedAt":"2026-10-28T13:46:48.782+00:00","statement":{"source":"cve-program","id":"CVE-2026-115904","aliases":[],"title":"Topluyo Desktop for Linux has an OS Command Injection issue","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","state":0,"publishedAt":"2026-10-28T12:55:04.432+00:00","modifiedAt":"2026-10-28T12:55:04.432+00:00","affected":[{"ecosystem":"Vendor product","name":"App","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"topluyo\",\n                    \"product\": \"App\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2026.9.2410\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115904","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115904","identifiers":["CVE-2026-115904"]},"retained":false,"historicalAffected":[]}],"coverage":[]}