CherryTree: OS command injection via CtActions (CVE-2026-118692)
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked, allowing command execution via shell metacharacters in web link URLs when the non-default Custom Web Link Clicked Action is enabled.
CVE search metadata
CVE search record: CVE-2026-118692. Severity: high. CVSS: 7.0. KEV: no. Product: CherryTree (through 1.7.2). Brief: CherryTree: OS command injection via CtActions (CVE-2026-118692). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cherrytree-command-injection/
Triage facts
Revision 1- Applicability
- CherryTree (through 1.7.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 22:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CherryTree versions through 1.7.2 contain an OS command injection vulnerability in the CtActions::link_clicked function. This vulnerability occurs when the non-default "Custom Web Link Clicked Action" option is enabled. Attackers can embed shell metacharacters such as $(...), backticks, or semicolons in web link URLs. When a user clicks such a link, the application passes the unquoted input to std::system, resulting in the execution of commands.