CVE-2026-115904
Topluyo is a social networking platform
- Risk score
- 63/100
- CVSS
- 9.6 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary opera…
- Affected
- See advisory
- Fix
- Upgrade the product to 2026.9.2410 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.6 critical
- Remotely exploitable without logging in
References
Original description
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
Last activity 28 Oct 2026. Patch Forecast updates every hour.