Topluyo Desktop CVE-2026-115904

Exploitation requires that the victim be running Topluyo Desktop for Linux at a version prior to 2026.9.2410 and that they open an attacker-controlled URL within the application, which is then passed to the vulnerable openExternalLinks() routine in utils.js and executed by the OS shell. No authentication is required (PR:N). The principal limiting factors are: mandatory user interaction (the user must open the malicious link, per UI:R), restriction to the Linux desktop build, and versions below 2026.9.2410 - the patched release removes the issue. Commands run only with the privileges of the user running the application, not elevated.

All severity signals point to a serious flaw: the supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes an unauthenticated, low-complexity, network-delivered OS command injection whose scope change (S:C) reflects the app-to-OS boundary being crossed, yielding full confidentiality, integrity and availability loss at the user's privilege level. The vuln.today Decision label is act_now, so remediation should be treated as urgent. However, the signals are not uniform: there is NO EPSS probability supplied, NO CISA KEV listing, and no confirmed public exploit - the only artifact is the vendor's GHSA security advisory, and the advisory itself states impact was 'verified in an isolated laboratory environment,' i.e. not observed in the wild. The one factor that materially tempers real-world risk is UI:R: exploitation requires the victim to open an attacker-controlled link inside the Topluyo Desktop client, so this is not a wormable, zero-click issue. Combined with the product's narrow deployment footprint (a Linux desktop client for a small social platform), the realistic picture is a high-severity but currently low-observed-exploitation issue whose urgency comes from the act_now decision and the critical technical impact, not from evidence of mass exploitation. Note the conflict to weigh: critical CVSS and act_now versus absent EPSS/KEV and a user-interaction requirement - treat as a priority patch, but there is no data indicating widespread active abuse.

An attacker crafts a malicious URL and lures a Topluyo Desktop (Linux) user to open it within the application; when the vulnerable openExternalLinks() routine in utils.js processes the URL, embedded shell metacharacters are passed to the operating system and arbitrary commands execute with the victim's privileges. The AV:N/AC:L/PR:N vector means no authentication or special skill is needed, but UI:R means the attack hinges on the victim actually opening the crafted link. No public exploit code is identified; the advisory states impact was verified only in an isolated lab.