{"affected":[{"product":"App","source":"CNA: GitHub_M","vendor":"topluyo","versions":[{"status":"affected","version":"< 2026.9.2410"}]}],"cveId":"CVE-2026-115904","cwes":["CWE-78"],"description":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","epss":{"date":"2026-11-02","percentile":0.54717,"score":0.00743},"exploits":[],"kev":null,"metrics":[{"score":9.6,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793710567973,"publishedAt":1793192104432,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7"}],"remediation":[],"revision":"44d23ad7f4749490e894cf6f946abb454137ecd8221e38892a75a791e6ad341f","sources":[{"modifiedAt":1793710567973,"name":"CNA: GitHub_M","retrievedAt":1793711363472,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115904"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793711369206,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115904"}],"ssvc":{"assessedAt":1793710344318,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Topluyo Desktop for Linux has an OS Command Injection issue","updatedAt":1793711369206}