Topluyo Desktop for Linux: OS command injection via external links
Summary
Topluyo Desktop for Linux processes user-controlled URLs unsafely in the openExternalLinks() routine, which allows OS command injection (CWE-78). An attacker who controls a link that a user opens can run arbitrary operating system commands with the privileges of that user. The attack requires user interaction (opening the link) but no login.
Affected
- Topluyo Desktop for Linux (topluyo App) before version 2026.9.2410
- Affected component: openExternalLinks() in utils.js
- Other platforms: Unknown.
Fixed in
- Version 2026.9.2410 and later
Workaround
Unknown. No workaround is documented by the vendor.
Exploitation
- No confirmed exploitation in the wild.
- Not listed in CISA KEV.
- No public exploit code known; one daily digest lists a GitHub PoC field that could not be verified.
Our recommendation
- Check whether Topluyo Desktop for Linux is installed on any endpoint and confirm the version.
- Upgrade to version 2026.9.2410 or later.
- Until patched, do not open links from untrusted sources in the Linux client.
- Monitor vendor advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vrrv-3f46-c3x7 github.com
- VulDB entry 427978 vuldb.com
- OffSeq Radar CVE-2026-115904 radar.offseq.com
- Strix CVE-2026-115904 www.strix.ai
- ThreatInt CVE-2026-115904 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:55.
Original description (NVD)
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.