CherryTree (Through 1.7.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cherrytree-through-1.7.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 22:48:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCherryTree: OS command injection via CtActions (CVE-2026-118692)https://feed.craftedsignal.io/briefs/2026-10-cherrytree-command-injection/Wed, 28 Oct 2026 22:48:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cherrytree-command-injection/CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked, allowing command execution via shell metacharacters in web link URLs when the non-default Custom Web Link Clicked Action is enabled.CherryTree versions through 1.7.2 contain an OS command injection vulnerability in the CtActions::link_clicked function. This vulnerability occurs when the non-default "Custom Web Link Clicked Action" option is enabled. Attackers can embed shell metacharacters such as $(...), backticks, or semicolons in web link URLs. When a user clicks such a link, the application passes the unquoted input to std::system, resulting in the execution of commands.

]]>highadvisory