CVE-2026-115904

Summary

A URL handling flaw in Topluyo Desktop for Linux before 2026.9.2410 allows remote attackers to trigger OS command injection by supplying a malicious URL that the app opens via its openExternalLinks() function, leading to arbitrary code execution with the user's privileges.

Exploitability

Exploitation requires the target user to click or otherwise interact with a malicious link provided by an attacker (e.g., via chat, email, or website), as the vulnerable function only executes when the user triggers it.

Blast radius

Successful exploitation grants attackers full control over the victim's system under the user's account, enabling data theft, lateral movement, or deployment of malware.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Topluyo Desktop for Linux to version 2026.9.2410 or later, which patches the unsafe URL handling in openExternalLinks().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.