Topluyo Desktop for Linux has an OS Command Injection issue

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…yo/App/security/advisories/GHSA-vrrv-3f46-c3x7 Diğer

Kayıt geçmişi

1. 28 Eki 2026 15:55Yayımlandı

İlgili açıklar

• 9,1 CVE-2026-67074HCL BigFix AEX is affected by multiple security vulnerabilities.
• 9,8 CVE-2026-114278Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
• 9,8 CVE-2026-118477KaliFast Project Management Platform ei_git_repo_url OS Command Injection
• 7,2 CVE-2026-110541Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 throug…
• 7,2 CVE-2026-86379Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versio…
• 7,2 CVE-2026-86394Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 throug…