Super Productivity Arbitrary OS Command Execution via IPC EXEC Handler (GHSA-256q-p9ff-jvdq)

Vulnerability Overview Vulnerability Name: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist Vulnerability ID: GHSA-256q-p9ff-jvdq CVSS Score: 7.8/10 Vulnerability Type: Command Injection Vulnerability Description: In the Super Productivity Electron application, there is an IPC EXEC handler that executes arbitrary operating system shell commands via Node.js's . The sole protection mechanism is a "Remember my answer" checkbox, which is selected by default. Once approved, the command is permanently added to a whitelist in and executed silently. Any code in the renderer process, including community plugins loaded via , can invoke this handler through the bridge. Affected Scope Affected Software: super-productivity/super-productivity Affected Version: v18.12.0 Fixed Version: 18.13.0 Remediation Fixed Version: Upgrade to version 18.13.0 or higher. POC Code Exploitation Steps 1. Create a malicious plugin ZIP file containing and , where contains . 2. Upload and enable the plugin via Settings > Plugins > Upload Plugin. 3. A confirmation dialog appears, with the "Remember my answer" checkbox selected by default. 4. Click the "Yes, execute!" button; the command executes and is permanently added to the whitelist. 5. Upon subsequent activations, the same command will execute silently without any dialog. Any other plugin can also execute this newly whitelisted command. Expected Result The command will execute with user privileges, supporting command chaining, pipes, and redirection, with no input sanitization.

Goal Reached Thanks to every supporter — we hit 100%!

Super Productivity Arbitrary OS Command Execution via IPC EXEC Handler (GHSA-256q-p9ff-jvdq)

More from this source