CVE-2026-115904: Topluyo Desktop for Linux has an OS Command Injection issue
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Topluyo Desktop for Linuxto a version that resolves this vulnerability.Fixed in 2026.9.2410
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running Topluyo Desktop for Linux versions earlier than 2026.9.2410 are exposed if they open a URL controlled by an attacker. Commands execute with the privileges of the user running the application.
What must an attacker do to exploit this issue?
The attacker must control a target URL and induce the user to open that link in the application. No attacker authentication or existing privileges are required, but user interaction is required.
Which version fixes the vulnerability?
Version 2026.9.2410 patches the issue. Systems running an earlier version should be updated to that version or later if available.