Live › vulnerability › CVE-2026-118692
Go to dashboardCherryTree, a desktop note-taking app, passes unquoted link URLs to a system shell when a custom web link action is enabled. A crafted document with shell metacharacters in a link runs attacker commands as the victim when they click the link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Only users who enable the non-default Custom Web Link Clicked Action option in CherryTree are exposed, and an attacker must get them to open a crafted document and click a link. Users with the default settings are not affected by the sources' description.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cherrytree | desktop | <= 1.7.2 | – |
1.7.2 are listed as affected.1.7.2 is the last affected version per NVDEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
This page as .md · .json · in your agent: get_signal("CVE-2026-118692")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.