CVE-2026-115904

critical · 9.6

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.

9.6

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-10-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-78

References

https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-115904