Live › vulnerability › CVE-2026-115904
Go to dashboardTopluyo Desktop for Linux builds a shell command from user-controlled URLs in its openExternalLinks() routine. An attacker who gets a victim to open a crafted link can run arbitrary operating system commands with the privileges of the user running the app.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Users of Topluyo Desktop for Linux built before version 2026.9.2410. The flaw is in the desktop client's handling of links, so the hosted web service and other platforms are not described as affected. Teams that do not run the Linux desktop client can skip it.
No product ranges from the sources yet.
2026.9.24102026.9.2410 or later, which patches the issueEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-115904")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.