Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115904— Topluyo Desktop for Linux has an OS Command Injection issue

Quick assessment

Affected
topluyo App
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Topluyo 是一个社交网络平台。在 Topluyo Desktop for Linux 2026.9.2410 之前的版本中存在一个漏洞：由于 中的 例程对用户可控的 URL 进行了不安全的处理，导致可通过操作系统命令注入。攻击者若能控制目标 URL，在用户打开该链接时，即可以运行该应用程序的用户的权限执行任意操作系统命令。该问题已在版本 2026.9.2410 中修复。

CVSS 9.6 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115904

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Topluyo Desktop for Linux has an OS Command Injection issue
Source: CVE Program / CVE List V5
Vulnerability Description
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
topluyo App < 2026.9.2410 -

II. Public POCs for CVE-2026-115904

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115904

请登录查看更多情报信息。

Other References for CVE-2026-115904 (1)

IV. Related Vulnerabilities

Same product: App
Same weakness: CWE-78