EUVD-2026-41735
GHSA-vv7r-8584-6pm6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
User must actively initiate repository import (UI:R); scope unchanged within Electron context; limited CIA impact consistent with vendor CVSS 4.0 VC:L/VI:L/VA:L ratings.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.
AnalysisAI
Code injection in TidGi-Desktop up to version 0.13.0 allows remote attackers to execute arbitrary code through the application's Git Repository Import feature, specifically within the sub-wiki loading worker. The flaw resides in src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts, where externally-sourced Git repository content is processed without adequate code-injection safeguards (CWE-94). A public exploit has been disclosed and referenced via the GitHub security advisory GHSA-9hc2-hjx8-q6pv, though no CISA KEV listing exists at time of analysis.
Technical ContextAI
TidGi-Desktop is an Electron-based desktop application that wraps TiddlyWiki with Git version control, enabling wiki tiddlers (pages) to be managed across local and remote Git repositories including sub-wikis. The vulnerable component is the loadWikiTiddlersWithSubWikis.ts worker, which is responsible for loading tiddler data from Git-backed sub-wiki repositories at import time. CWE-94 (Improper Control of Generation of Code) points to the root cause: externally-controlled content from a Git repository is being processed in a manner that allows code to be injected and evaluated, a pattern common in wiki/notebook systems where the boundary between data and executable code is thin. Because TidGi-Desktop runs as an Electron application, injected code executes within the Node.js runtime context embedded in the app, which can carry significant system-level access depending on Electron sandbox configuration. The CPE cpe:2.3:a:tiddly-gittly:tidgi-desktop:*:*:*:*:*:*:*:* covers all versions up to and including 0.13.0.
RemediationAI
Users should consult the GitHub Security Advisory GHSA-9hc2-hjx8-q6pv at https://github.com/tiddly-gittly/TidGi-Desktop/security/advisories/GHSA-9hc2-hjx8-q6pv for the authoritative patch guidance; a specific fixed release version is not independently confirmed from the available references, so users should monitor the project repository at https://github.com/tiddly-gittly/TidGi-Desktop/ for a tagged patched release. As a compensating control prior to patching, strictly avoid importing Git repositories from untrusted, unverified, or third-party sources, since the vulnerability is triggered exclusively through the Git Repository Import workflow. Additionally, restricting the application's network access via host-based firewall rules will reduce exposure to remotely-hosted malicious repositories, though this may impair legitimate sync functionality. No generic 'defense in depth' measures substitute for applying the vendor patch once a confirmed fixed version is released.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today