{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/tidgi-desktop-0.13.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TidGi Desktop 0.13.0"],"_cs_severities":["critical"],"_cs_tags":["rce","vulnerability","initial-access","execution","windows","macos","linux"],"_cs_type":"advisory","_cs_vendors":["Lin Onetwo"],"content_html":"\u003cp\u003eTidGi Desktop, up to and including version 0.13.0, is affected by a critical remote code execution vulnerability. This flaw can be exploited when a user imports a specially crafted TiddlyWiki repository. The vulnerability stems from TiddlyWiki's module system, which automatically discovers and executes JavaScript code embedded in \u003ccode\u003e.tid\u003c/code\u003e files placed in the wiki's \u003ccode\u003etiddlers/\u003c/code\u003e directory. Specifically, \u003ccode\u003e.tid\u003c/code\u003e files are auto-loaded into the wiki store, modules with \u003ccode\u003emodule-type: startup\u003c/code\u003e are automatically registered, and their \u003ccode\u003eexports.startup()\u003c/code\u003e function is executed during the wiki's boot sequence with full Node.js \u003ccode\u003erequire()\u003c/code\u003e access. This allows an attacker to execute arbitrary commands on the victim's system, confirmed on macOS with TiddlyWiki 5.4.0 and Node.js v26. No authentication is required beyond a single user interaction to import the malicious repository, making it a high-impact vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious TiddlyWiki repository containing a \u003ccode\u003e.tid\u003c/code\u003e file with \u003ccode\u003emodule-type: startup\u003c/code\u003e and JavaScript code in the \u003ccode\u003eexports.startup\u003c/code\u003e function (e.g., \u003ccode\u003erequire('child_process').execSync('calc');\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe victim is enticed to import the malicious repository into TidGi Desktop, typically by clicking \u0026quot;Add Workspace\u0026quot; and selecting the attacker-controlled Git repository or local folder.\u003c/li\u003e\n\u003cli\u003eTidGi Desktop initiates the wiki boot sequence, which involves \u003ccode\u003e$tw.boot.startup()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDuring \u003ccode\u003eloadStartup()\u003c/code\u003e, the \u003ccode\u003eloadTiddlersNode()\u003c/code\u003e function reads all \u003ccode\u003e.tid\u003c/code\u003e files from the filesystem, including the attacker's malicious file, and adds them to the wiki store via \u003ccode\u003ewiki.addTiddlers()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSubsequently, \u003ccode\u003eexecStartup()\u003c/code\u003e calls \u003ccode\u003edefineTiddlerModules()\u003c/code\u003e, which iterates through all tiddlers in the store. The attacker's tiddler, having \u003ccode\u003emodule-type: startup\u003c/code\u003e, is registered as an executable module.\u003c/li\u003e\n\u003cli\u003eThe boot sequence proceeds to \u003ccode\u003eforEachModuleOfType(\u0026quot;startup\u0026quot;, ...)\u003c/code\u003e, collecting all registered \u0026quot;startup\u0026quot; modules, including the attacker's.\u003c/li\u003e\n\u003cli\u003eFinally, \u003ccode\u003eexecuteNextStartupTask()\u003c/code\u003e calls the \u003ccode\u003eexports.startup()\u003c/code\u003e function of the collected modules without platform restrictions, leading to the execution of the attacker's JavaScript code with full Node.js privileges.\u003c/li\u003e\n\u003cli\u003eArbitrary commands, such as launching \u003ccode\u003ecalc.exe\u003c/code\u003e or creating files, are executed on the victim's operating system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to critical consequences, including full Node.js access for the attacker, enabling remote code execution on the victim's machine. Attackers can leverage this access to perform arbitrary file reads and writes, establish reverse shells using Node.js's \u003ccode\u003enet\u003c/code\u003e module, and establish persistence by writing to startup scripts or other system mechanisms. The vulnerability affects Windows, macOS, and Linux systems and requires only a single user interaction (importing the repository). Given that TidGi Desktop is a personal knowledge base and note-taking application, a compromise could lead to significant data exfiltration, system damage, or further lateral movement within an affected environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable comprehensive \u003ccode\u003eprocess_creation\u003c/code\u003e logging across all endpoints running TidGi Desktop to detect unusual child processes spawned by Node.js or TidGi-Desktop, leveraging the Sigma rule provided in this brief.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003efile_event\u003c/code\u003e logs for suspicious file creations, especially in temporary directories (\u003ccode\u003e/tmp\u003c/code\u003e on Linux/macOS, \u003ccode\u003e%TEMP%\u003c/code\u003e on Windows), originating from the TidGi-Desktop process or its child processes.\u003c/li\u003e\n\u003cli\u003eEducate users about the risks of importing untrusted repositories or files into applications like TidGi Desktop.\u003c/li\u003e\n\u003cli\u003eImplement application whitelisting solutions to restrict execution of unknown or untrusted executables, particularly those launched as child processes by applications like TidGi Desktop.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-14T20:17:42Z","date_published":"2026-07-14T20:17:42Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tidgi-rce/","summary":"A critical remote code execution (RCE) vulnerability exists in TidGi Desktop through version 0.13.0, allowing attackers to execute arbitrary code with full Node.js access by tricking victims into importing a specially crafted TiddlyWiki Git repository, leveraging the automatic execution of 'startup' modules during the wiki boot sequence.","title":"TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import","url":"https://feed.craftedsignal.io/briefs/2026-07-tidgi-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - TidGi Desktop 0.13.0","version":"https://jsonfeed.org/version/1.1"}