EUVD-2026-61102Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L because the Electron app runs locally; PR:N because plugin installation requires no elevated OS or application privileges; UI:R because a user must install and activate the malicious plugin; full C/I/A impact because arbitrary shell execution at desktop account level is achieved.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0.
AnalysisAI
Arbitrary OS command execution in Super Productivity's Electron desktop app (versions prior to 18.13.0) allows any community plugin or renderer-accessible script to invoke child_process.exec() with the user's desktop account privileges via the unguarded window.ea.exec() IPC bridge, completely bypassing the nodeExecution permission gate that protects the sanctioned script-execution path. The attack surface is broader than a typical plugin vulnerability: JavaScript plugins execute via new Function() in the host renderer context, and iframe plugins run with allow-same-origin, granting direct window.parent.ea access - meaning no postMessage bridge filtering applies. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable `window.ea.exec()` IPC path is reachable by: (1) any JavaScript community plugin loaded via `new Function()` in the host renderer, without requiring the `nodeExecution` permission to be granted - this bypass is the core flaw; (2) any iframe plugin, because iframe plugins render with `allow-same-origin` and can call `window.parent.ea.exec()` directly, circumventing the postMessage filter entirely; or (3) any cross-site scripting payload reaching the Electron renderer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score with AV:L reflects that exploitation requires local presence of the application and user interaction (UI:R), reducing opportunistic mass exploitation compared to a network-facing vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Super Productivity to version 18.13.0 or later, confirmed by GitHub advisory GHSA-256q-p9ff-jv8q and commit 97e97042cde2e33524c9ad50dd46312c56be0072, which deletes `electron/ipc-handlers/exec.ts` entirely, removes the `initExecIpc()` call from the IPC wiring, and strips the `exec()` method from both the preload bridge and the `ElectronAPI` TypeScript interface. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Super Productivity installations across development teams and audit plugin sources, disabling any from untrusted origins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today