Nerimity Desktop EUVD-2026-105022

Exploitation requires the victim to be running a vulnerable Nerimity Desktop build (up to 2.2.2) and to interact with attacker-supplied content (UI:P) that reaches the Window Open Handler in src/mainWindow.js; before the fix, any URL - including dangerous non-http(s) custom schemes - was passed unconditionally to shell.openExternal, so no authentication is required (PR:N). The key limiting factors are the mandatory user interaction, the need for the attacker to deliver the crafted link into the client, and the requirement that the victim's OS have a registered handler for the abused custom scheme; patched versions (2.3.3+) restrict shell.openExternal to http:/https: protocols, eliminating the condition.

This is a medium-severity, lower-priority issue in practice. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, score 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction (UI:P) and yields only Low impact to confidentiality, integrity, and availability with no scope change. The E:P subscore aligns with the input signal that publicly available exploit code exists. Not listed in CISA KEV, so this is NOT confirmed actively exploited - it is 'publicly available exploit code exists,' which is a distinct and weaker signal than in-the-wild abuse. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed; this is a data gap. There is no SSVC decision record in the input. The source-code diff corroborates the described root cause (shell.openExternal called on an unvalidated URL, now gated to http/https), so the technical claim is well-supported. Net: a real but modest issue - the mandatory user interaction, uniformly Low impacts, and niche product footprint keep real-world risk well below what the 'public exploit' label alone might suggest.

An attacker places a message or content containing a crafted URL with a dangerous custom scheme inside the Nerimity chat client; when the victim interacts with it, the window-open handler passes the URL straight to shell.openExternal without validating the protocol, causing the OS to invoke an arbitrary registered protocol handler. A public proof-of-concept exists, and the network attack vector with low complexity makes delivery trivial, though the victim must still interact with the malicious link.