CVE-2026-115904
topluyo App
- topluyo App
- Critical
- CVSS 9.6
- No fixed version listed
Summary
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`.
From the CVE record.
Read the original description
CVE record
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
What to do
No fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| topluyo App | < 2026.9.2410 | None listed |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.6 (v3.1, scored by GitHub_M)
- Weakness
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Vendor
- topluyo, App
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.