Product
Topluyo Desktop for Linux versions prior to 2026.9.2410 are vulnerable to OS Command Injection via the openExternalLinks function in utils.js, allowing unauthenticated attackers to achieve RCE through malicious link-handling.