{"id":"CVE-2026-115904","kind":"vulnerability","aliases":["CVE-2026-115904"],"related":[],"title":"Topluyo Desktop for Linux: crafted link runs OS commands as user","description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","summary":"Topluyo Desktop for Linux builds a shell command from user-controlled URLs in its openExternalLinks() routine. An attacker who gets a victim to open a crafted link can run arbitrary operating system commands with the privileges of the user running the app.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-client","linux","other","topluyo"],"not_affected_if":["other-platforms","web-only-use"],"how_to_check":"- Run the installed Topluyo Desktop and check its version against `2026.9.2410`\n- Check whether the Linux desktop client is installed on user machines that open external links from Topluyo","fix":"- Upgrade Topluyo Desktop for Linux to `2026.9.2410` or later, which patches the issue","status":"open","published_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:33:56+00:00","updated_at":"2026-10-28T13:33:56+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-28T13:33:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Topluyo Desktop for Linux to `2026.9.2410` or later, which patches the issue","reach":"internet","title":"Topluyo Desktop for Linux: crafted link runs OS commands as user","impact":"high","summary":"Topluyo Desktop for Linux builds a shell command from user-controlled URLs in its openExternalLinks() routine. An attacker who gets a victim to open a crafted link can run arbitrary operating system commands with the privileges of the user running the app.","category":"other","nicknames":[],"who_cares":["topluyo","linux","desktop-client"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Arbitrary OS commands run as the logged-in user on the machine","analyst_note":"Confirm the affected version range and the exact trigger path for openExternalLinks() in utils.js from the upstream advisory or NVD detail page.","how_to_check":"- Run the installed Topluyo Desktop and check its version against `2026.9.2410`\n- Check whether the Linux desktop client is installed on user machines that open external links from Topluyo","needs_analyst":true,"not_affected_if":["web-only-use","other-platforms"],"who_is_affected":"Users of Topluyo Desktop for Linux built before version 2026.9.2410. The flaw is in the desktop client's handling of links, so the hosted web service and other platforms are not described as affected. Teams that do not run the Linux desktop client can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000607,"input_tokens":3348,"output_tokens":544,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-115904':14A,17A '-2026':13A,16A '2026.9.2410':84C,131C 'app':66B 'applic':125C 'arbitrari':54B,113C 'attack':42B,105C 'build':28B 'client':20B 'command':9A,31B,57B,96C,116C 'control':35B,88C,107C 'craft':5A,50B 'cve':12A,15A 'desktop':2A,19B,25B,78C 'desktop-cli':18B 'execut':112C 'exist':75C 'get':44B 'inject':97C 'issu':134C 'lead':93C 'link':6A,51B,129C 'linux':4A,21B,27B,80C 'network':71C 'open':48B,127C 'openexternallink':39B,100C 'oper':55B,114C 'os':8A,95C 'patch':132C 'platform':72C 'prior':81C 'privileg':60B,119C 'process':92C 'routin':40B,101C 'run':7A,53B,64B,123C 'shell':30B 'social':70C 'system':56B,115C 'target':109C 'topluyo':1A,23B,24B,67C,77C 'unsaf':91C 'upon':126C 'url':36B,89C,110C 'user':11A,34B,63B,87C,122C 'user-control':33B,86C 'utils.js':103C 'version':83C,130C 'via':98C 'victim':46B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Users of Topluyo Desktop for Linux built before version 2026.9.2410. The flaw is in the desktop client's handling of links, so the hosted web service and other platforms are not described as affected. Teams that do not run the Linux desktop client can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115904","severity":null,"published_at":"2026-10-28T13:17:05+00:00","modified_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}